Vitejs

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

In CISA KEV

Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

also in 2 other products

Vite bypasses server.fs.deny when using `?raw??`

Vite allows server.fs.deny to be bypassed with .svg or relative paths

Vite has a `server.fs.deny` bypass with queries

also in 2 other products

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

also in 2 other products

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

Vitejs: Path Traversal

also in 1 other product

Vite has an `server.fs.deny` bypass with an invalid `request-target`

Vite Launch-editor: Argument Injection

also in 2 other products

Vite: `server.fs.deny` bypass on Windows alternate paths

also in 1 other product

Vitejs: Path Traversal

Vite has a Path Traversal in Optimized Deps `.map` Handling

also in 2 other products

Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

also in 1 other product

launch-editor vulnerable to command injection via the crafted request on Windows

also in 1 other product

Vite middleware may serve files starting with the same name with the public directory

vite allows server.fs.deny bypass via backslash on Windows

launch-editor: escapeCmdArgs() omits % escaping on Windows

also in 2 other products

Vite: `server.fs.deny` bypassed with queries

Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite

server.fs.deny bypassed when using ?import&raw in vite

Vitejs: Path Traversal

Vite: Cross origin script execution through Vite custom middleware

also in 1 other product

DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite