Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-35204 · ADVISORY
• vitejs/vite · WEB
• vitejs/vite commit 6851009 · WEB
• vitejs/vite commit e109d64 · WEB
• vitejs/vite · PACKAGE
• vitejs/vite release v2.9.13 · WEB
• vitejs/vite release v3.0.0-beta.4 · WEB

vite のその他の脆弱性

• CVE-2026-53571高 7.5Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.f…
• CVE-2026-39365中 5.3Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map request…
• CVE-2026-39364高 7.5Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be bloc…
• CVE-2026-39363高 7.5Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite …
• CVE-2025-58752中 5.3Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were s…