Vite

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

In CISA KEV

Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

also in 1 other product

Vite bypasses server.fs.deny when using `?raw??`

Vite allows server.fs.deny to be bypassed with .svg or relative paths

Vite has a `server.fs.deny` bypass with queries

also in 1 other product

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

Vitejs: Path Traversal

Vite-plugin-react: Code Injection

Vite has an `server.fs.deny` bypass with an invalid `request-target`

Vite Launch-editor: Argument Injection

Vite: `server.fs.deny` bypass on Windows alternate paths

also in 1 other product

Vitejs: Path Traversal

Vite has a Path Traversal in Optimized Deps `.map` Handling

also in 1 other product

Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

launch-editor vulnerable to command injection via the crafted request on Windows

Vite middleware may serve files starting with the same name with the public directory

vite allows server.fs.deny bypass via backslash on Windows

Vitest: Files or Directories Accessible to External Parties

also in 2 other products

launch-editor: escapeCmdArgs() omits % escaping on Windows

Vite: `server.fs.deny` bypassed with queries

Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite

Vite-plugin-react: Path Traversal

server.fs.deny bypassed when using ?import&raw in vite