8000 Security Overview · vitejs/vite · GitHub

More Web Proxy on the site http://driver.im/

Security

Report a vulnerability

SECURITY.md

Reporting a Vulnerability

To report a vulnerability, please open a private vulnerability report at https://github.com/vitejs/vite/security.

While the discovery of new vulnerabilities is rare, we also recommend always using t 8497 he latest versions of Vite and its official plugins to ensure your application remains as secure as possible.

`server.fs.deny` bypassed with `/.` for files under project `root`
GHSA-859w-5945-r5v3 published Apr 30, 2025 by sapphi-red

Moderate
`server.fs.deny` bypassed with an invalid `request-target`
GHSA-356w-63v5-8wf4 published Apr 10, 2025 by sapphi-red

Moderate
`server.fs.deny` bypassed with `.svg` or relative paths
GHSA-xcj6-pq6g-qj4x published Apr 3, 2025 by patak-dev

Moderate
`server.fs.deny` bypassed for `inline` and `raw` with `?import` query
GHSA-4r4m-qw57-chr8 published Mar 31, 2025 by patak-dev

Moderate
server.fs.deny bypassed when using `?raw??`
GHSA-x574-m823-4x7w published Mar 24, 2025 by sapphi-red

Moderate
Any websites were able to send any requests to the development server and read the response
GHSA-vg6x-rcgg-rjx6 published Jan 20, 2025 by sapphi-red

Moderate
DOM Clobbering gadget found in vite bundled scripts that leads to XSS
GHSA-64vr-g452-qvp3 published Sep 17, 2024 by patak-dev

Moderate
server.fs.deny bypassed when using ?import&raw
GHSA-9cwx-2883-4wfx published Sep 17, 2024 by patak-dev

Moderate
`server.fs.deny` did not deny requests for patterns with directories.
GHSA-8jhw-289h-jh2g published Apr 3, 2024 by sapphi-red

Moderate
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
GHSA-c24v-8rfc-w8vw published Jan 19, 2024 by patak-dev

High

Learn more about advisories related to vitejs/vite in the GitHub Advisory Database

0