vite-plus has 3 advisories. Version not read yet.
npm ↗Versions
Red: affected by at least one advisory. White: safe. The dot is the version in your lockfile.
Details
- You run
- not in lockfile
- Safe
- 1.1.0
- Advisories
- 3 in 120 days
Used by
Stacks that pull this package.
Not part of a tracked stack.
Alerts(3)
Source summary
Summary When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server. Impact Only apps that match the following conditions are affected: - the dev server passes an unchanged browser request URL to server.transformIndexHtml : this is normally used for server.middlewareMode: true or appType: 'custom' . The internal call for appType: 'spa' and appType: 'mpa' does not match this. - the transformed HTML contains an inline module script - from the script in the page served by the dev server, the app stores sensitive v
- Affected
- vite >=8.3.0 <=8.3.2 · vite >=8.2.0 <=8.2.3 · vite >=8.0.0 <=8.1.5 · vite >=7.0.0 <=7.3.6 · vite <=6.4.3 · vite-plus <=1.0.0
- Fixed in
- 8.3.3 · 8.2.4 · 8.1.6 · 7.3.7 · 6.4.4 · 1.1.0
- ID
- GHSA-9jrq-w75r-8gcw
Source summary
Summary The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance . Impact Only apps that match one of the following conditions are affected: - explicitly expose the Vite dev server to the network using --host or the [ server.host ](https://vite.dev/config/server-options server-host) option - there's a file that has a sensitive information in the first 4 bytes - uses Node.js or Deno to run Vite (if Bun is used, it is not affected) Details Requests containing the ?vite-wasm-instance query are handled by the internal Wasm p
- Affected
- vite >=8.3.0 <=8.3.2 · vite >=8.2.0 <=8.2.3 · vite-plus >=0.2.8 <=1.0.0
- Fixed in
- 8.3.3 · 8.2.4 · 1.1.0
- ID
- GHSA-vfpm-58rq-9qcg
Source summary
Summary The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root . For example, if the project references /etc/hosts , the content of /etc/hosts was possible to be returned. The content of files outside the server.fs.allow option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing /etc/hosts could make Vite return the host's /etc/hosts file. Impact Only apps that meet all of the following conditions are affected: - e
- Affected
- vite >=8.3.0 <=8.3.2 · vite >=8.2.0 <=8.2.3 · vite >=8.0.0 <=8.1.5 · vite >=7.0.0 <=7.3.6 · vite <=6.4.3 · vite-plus <=1.0.0
- Fixed in
- 8.3.3 · 8.2.4 · 8.1.6 · 7.3.7 · 6.4.4 · 1.1.0
- ID
- GHSA-rq7h-c2jc-7f22