Vite's bundling process for cjs, iife, and umd output formats replaces relative asset paths using the URL from document.currentScript. However, document.currentScript can be shadowed by an attacker-controlled HTML element named 'currentScript', enabling the attacker to control the script URL used for dynamic imports. This DOM Clobbering gadget can be exploited by injecting scriptless HTML elements (e.g., an img tag with name='currentScript') into the page, leading to loading malicious scripts from attacker-controlled servers and resulting in cross-site scripting (XSS). The vulnerability is demonstrated with a proof-of-concept where an attacker injects an img element named 'currentScript' to hijack script loading.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the vulnerable web page, resulting in cross-site scripting (XSS). This can lead to data theft, session hijacking, or other malicious actions depending on the attacker's payload. The impact is limited to web pages that include Vite-bundled scripts configured with the vulnerable output formats and that allow injection of scriptless attacker-controlled HTML elements.

A patch is available for this vulnerability. Users should upgrade Vite to a fixed version at or above 5.4.6. Until patched, avoid using the cjs, iife, or umd output formats if possible, and ensure that user input is properly sanitized to prevent injection of attacker-controlled HTML elements with names that could shadow document.currentScript. Review the vendor advisory for detailed patch and mitigation instructions.