GHSA-93m4-6634-74q7
Suggest an improvement- Source
- https://github.com/advisories/GHSA-93m4-6634-74q7
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-93m4-6634-74q7/GHSA-93m4-6634-74q7.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-93m4-6634-74q7
- Aliases
- Downstream
- Related
- Published
- 2025-10-20T19:54:28Z
- Modified
- 2025-10-21T14:51:26Z
- Severity
-
- 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- vite allows server.fs.deny bypass via backslash on Windows
- Details
-
Summary
Files denied by <code>server.fs.deny</code> were sent if the URL ended with
\when the dev server is running on Windows.Impact
Only apps that match the following conditions are affected:
- explicitly exposes the Vite dev server to the network (using --host or <code>server.host</code> config option)
- running the dev server on Windows
Details
server.fs.denycan contain patterns matching against files (by default it includes.env,.env.*,*.{crt,pem}as such patterns). These patterns were able to bypass by using a back slash(\). The root cause is thatfs.readFile('/foo.png/')loads/foo.png.PoC
npm create vite@latest cd vite-project/ cat "secret" > .env npm install npm run dev curl --request-target /.env\ http://localhost:5173<img width="1593" height="616" alt="image" src="https://github.com/user-attachments/assets/36212f4e-1d3c-4686-b16f-16b35ca9e175" />
- Database specific
{ "nvd_published_at": "2025-10-20T20:15:37Z", "github_reviewed": true, "github_reviewed_at": "2025-10-20T19:54:28Z", "severity": "MODERATE", "cwe_ids": [ "CWE-22" ] }- References
Affected packages
npm
vite
Package
- Name
- vite
- View open source insights on deps.dev
- Purl
- pkg:npm/vite
vite
Package
- Name
- vite
- View open source insights on deps.dev
- Purl
- pkg:npm/vite
vite
Package
- Name
- vite
- View open source insights on deps.dev
- Purl
- pkg:npm/vite
vite
Package
- Name
- vite
- View open source insights on deps.dev
- Purl
- pkg:npm/vite
vite
Package
- Name
- vite
- View open source insights on deps.dev
- Purl
- pkg:npm/vite
vite
Package
- Name
- vite
- View open source insights on deps.dev
- Purl
- pkg:npm/vite
vite
Package
- Name
- vite
- View open source insights on deps.dev
- Purl
- pkg:npm/vite