Vite is a frontend tooling framework for JavaScript

Why it is Yellow

• CVSS 6.9 medium

References

• https://github.com/vitejs/vite/commit/91e40d7bf9777057bbd31c3eb036a54c9465697e
• https://github.com/vitejs/vite/pull/22160
• https://github.com/vitejs/vite/pull/23855
• https://github.com/vitejs/vite/releases/tag/v6.4.5
• https://github.com/vitejs/vite/security/advisories/GHSA-8g5g-mxqh-grgj

Original description

Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.