| Package | Affected versions | Patched versions |
|---|---|---|
| vite | ≥ 6.4.4, < 6.4.5 | 6.4.5 |
The contents of files that are specified by server.fs.deny can be returned to the browser. This is the same as https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r.
Only apps that match the following conditions are affected:
--host or server.host config option)server.fs.allowserver.fs.denyOn the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended.
For the fix for https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22, v6.4.4 back-ported https://github.com/vitejs/vite/pull/20410. But while that PR requires https://github.com/vitejs/vite/pull/22160 for https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r, https://github.com/vitejs/vite/pull/22160 wasn't back-ported together causing v6 vulnerable to https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free