• Vite v6 dev server is in use (v6.4.4 line, which back-ported PR 20410 without PR 22160).
• Vite dev server is explicitly exposed to the network via --host or the server.host config option.
• The sensitive file exists within the directories allowed by server.fs.allow.
• The sensitive file is matched by a pattern in server.fs.deny (e.g., .env, .crt).

Affected

vite 6.4.4

Fixed in

6.4.5

ID

GHSA-8g5g-mxqh-grgj

• Project uses launch-editor directly, via launch-editor-middleware, or via Vite.
• An attacker can create a file or directory whose name starts with + or - in the working directory.
• The editor used or specified is Vim/gVim, MacVim, Emacs/Emacsclient, or Notepad++ with a plugin exposing dangerous operations via plugin messages.
• For direct launch-editor use: the first argument passed to launchEditor can start with + or -, or the user is on WSL.
• For launch-editor-middleware: launch-editor older than v2.2.0 is used, or the user is on WSL.
• For Vite (2.0.0+): the user is running under WSL.

Affected

vite >=8.3.0 <=8.3.2 · vite >=8.2.0 <=8.2.3 · vite >=8.0.0 <=8.1.5 · vite >=7.0.0 <=7.3.6 · vite <=6.4.3

Fixed in

8.3.3 · 8.2.4 · 8.1.6 · 7.3.7 · 6.4.4

ID

GHSA-r825-w8mm-5pxw

• Project uses launch-editor (or launch-editor-middleware) at an affected version.
• The app runs on Windows.
• An attacker can control the file argument passed to launch-editor.

Affected

vite >=8.3.0 <=8.3.2 · vite >=8.2.0 <=8.2.3 · vite >=8.0.0 <=8.1.5 · vite >=7.0.0 <=7.3.6 · vite <=6.4.3

Fixed in

8.3.3 · 8.2.4 · 8.1.6 · 7.3.7 · 6.4.4

ID

GHSA-587h-7wmj-h5pm

• Project uses launch-editor (version without % escaping in escapeCmdArgs).
• Application runs on Windows, where launch-editor invokes .bat/.cmd editors via cmd.exe.
• An attacker can place a file whose filename contains & or %.
• An attacker can inject an environment variable with a malicious value, or can add an NTFS alternate data stream to the placed file.
• An attacker can control the filename argument passed to launchEditor.

Affected

vite >=8.3.0 <=8.3.2 · vite >=8.2.0 <=8.2.3 · vite >=8.0.0 <=8.1.5 · vite >=7.0.0 <=7.3.6 · vite <=6.4.3

Fixed in

8.3.3 · 8.2.4 · 8.1.6 · 7.3.7 · 6.4.4

ID

GHSA-698v-4r3x-3vcv

Source summary

Summary When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server. Impact Only apps that match the following conditions are affected: - the dev server passes an unchanged browser request URL to server.transformIndexHtml : this is normally used for server.middlewareMode: true or appType: 'custom' . The internal call for appType: 'spa' and appType: 'mpa' does not match this. - the transformed HTML contains an inline module script - from the script in the page served by the dev server, the app stores sensitive v

Affected

vite >=8.3.0 <=8.3.2 · vite >=8.2.0 <=8.2.3 · vite >=8.0.0 <=8.1.5 · vite >=7.0.0 <=7.3.6 · vite <=6.4.3 · vite-plus <=1.0.0

Fixed in

8.3.3 · 8.2.4 · 8.1.6 · 7.3.7 · 6.4.4 · 1.1.0

ID

GHSA-9jrq-w75r-8gcw

Source summary

Summary The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root . For example, if the project references /etc/hosts , the content of /etc/hosts was possible to be returned. The content of files outside the server.fs.allow option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing /etc/hosts could make Vite return the host's /etc/hosts file. Impact Only apps that meet all of the following conditions are affected: - e

Affected

vite >=8.3.0 <=8.3.2 · vite >=8.2.0 <=8.2.3 · vite >=8.0.0 <=8.1.5 · vite >=7.0.0 <=7.3.6 · vite <=6.4.3 · vite-plus <=1.0.0

Fixed in

8.3.3 · 8.2.4 · 8.1.6 · 7.3.7 · 6.4.4 · 1.1.0

ID

GHSA-rq7h-c2jc-7f22