| Package | Affected versions | Patched versions |
|---|---|---|
| vite | ≥ 7.0.0, < 7.3.5≥ 8.0.0, < 8.0.16< 6.4.3 | 7.3.58.0.166.4.3 |
| vite+ | < 0.1.24 | 0.1.24 |
| vite | ≥ 7.0.0, < 7.3.5≥ 8.0.0, < 8.0.16< 6.4.3 | 7.3.58.0.166.4.3 |
| vite-plus | < 0.1.24 | 0.1.24 |
The contents of files that are specified by server.fs.deny can be returned to the browser on Windows.
Only apps that match the following conditions are affected:
--host or server.host config option)server.fs.allowVite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied.
Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream.
Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them.
$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev
Access via browser at http://localhost:5173/.env::$DATA?raw
<img width="388" height="129" alt="deecc1315123883cfd0f9c26a002845a" src="https://github.com/user-attachments/assets/895c6012-4e2e-4a35-babb-69bbf3ee7170" />
Example expected result:
/.env::$DATA?raw returns the contents of .env/tls.pem::$DATA?raw returns the contents of tls.pemRunning one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free