The Vite development server option `server.fs.deny` can be bypassed on case-insensitive filesystems, such as Windows, by using case-augmented filenames. This allows an attacker to access files that are intended to be blocked by the deny list. The issue arises because the underlying glob matching is case-sensitive, while the filesystem is not, enabling blacklist bypass. This vulnerability affects Vite versions from 2.7.0 up to but not including 5.0.12 and has been fixed in 5.0.12 and earlier patch releases of prior major versions.
Vite's development server option `server.fs.deny` did not properly deny requests for patterns that include directories, such as `/foo/**/*`. This issue affects applications that customize `server.fs.deny` with directory patterns and expose the Vite dev server to the network. The vulnerability arises from the use of picomatch with the `matchBase: true` option, which only matches basenames and not full paths, allowing unauthorized access to files under denied directories like `.git`. This flaw was fixed in multiple Vite versions starting with 2.9.18, 3.2.10, 4.5.3, 5.0.13, 5.1.7, and 5.2.6.
Vite versions from 2.5.1 up to but not including 5.4.6 contain a vulnerability where the server's file system access restrictions can be bypassed using the '?import&raw' query parameters. This allows an attacker to retrieve the contents of arbitrary files outside the intended serving allow list. The vulnerability has a medium severity with a CVSS score of 5.3.
A DOM Clobbering vulnerability in Vite affects bundled scripts built with output formats cjs, iife, or umd. This flaw allows an attacker to manipulate the document.currentScript property by injecting a scriptless HTML element named 'currentScript', causing the application to load attacker-controlled scripts dynamically. This can lead to cross-site scripting (XSS) in web pages that include vulnerable Vite bundles and allow embedding of such HTML elements. The vulnerability impacts Vite versions from 2.5.1 up to but not including 5.4.6. A fix is available.
Vite development server versions from 2.5.1 up to but not including 6.0.9 have a vulnerability that allows any website to send requests to the dev server and read responses due to permissive default CORS settings and lack of Origin header validation on WebSocket connections. This affects even local-only dev servers. The vulnerability can expose sensitive development files to malicious websites. A fix is available in newer Vite versions. Mitigations include configuring CORS origins, allowed hosts, and using HTTPS or updated browsers. Some mitigations are not possible without upgrading.
A vulnerability in Vite allows bypassing the server.fs.deny restriction when using the ?raw?? or ?import&raw?? query parameters, enabling access to arbitrary file contents. This affects Vite dev servers explicitly exposed to the network via the --host option or server.host configuration. The issue arises because trailing separators in the query string are removed inconsistently, allowing unauthorized file reads outside the allowed serving paths. A proof of concept demonstrates reading sensitive files such as /tmp/secret.txt. The vulnerability affects Vite versions from 2.5.1 up to but not including 6.2.3. A patch is available to address this issue. The CVSS score is 5.3 (medium severity).
Vite versions from 2.5.1 up to but not including 6.2.5 have a vulnerability that allows arbitrary file contents to be returned to the browser. This occurs when the Vite development server is exposed to the network using the --host option or server.host configuration. The vulnerability involves bypassing the server.fs.deny restriction via requests ending with .svg or using relative paths before normalization. The issue affects files smaller than the default 4kB inline asset limit in Vite 6.0 and later. Exploitation requires network access to the dev server and user interaction (UI:R).
Vite versions from 2.5.1 up to but not including 6.2.6 have a vulnerability in the dev server's file system access control. When running on Node or Bun runtimes and explicitly exposed to the network, specially crafted HTTP requests with an invalid request-target containing a '#' character can bypass the server.fs.deny check. This allows an attacker to retrieve arbitrary files from the server. The vulnerability does not affect Vite running on Deno due to different URL handling. A proof-of-concept demonstrates reading sensitive files like /etc/passwd via this bypass.
Kimi CLI's GitPython integration contains a vulnerability (CVE-2026-67326) where newline injection in the config_writer() section parameter bypasses prior patch CVE-2026-42215. This allows an attacker controlling the section argument to inject newlines into .git/config, creating forged sections such as [core] with a malicious hooksPath. This leads to remote code execution (RCE) when git hooks are triggered. The vulnerability affects multiple version ranges of kimi-cli. A patch is available.
A vulnerability in Kimi CLI's GitPython integration (CVE-2026-42284) allows unsafe command-line options to bypass validation due to improper checking before shell splitting. Specifically, multi_options passed to clone operations are validated as original strings but executed after splitting, enabling injection of malicious git config options that execute attacker-controlled hooks during cloning or submodule updates.
GitPython versions up to 3.1.53 contain a remote code execution vulnerability (CVE-2026-73625) in the check_unsafe_options guard. The vulnerability allows bypassing the guard by embedding a malicious git option token inside the value of a single-character keyword argument, enabling arbitrary OS command execution via the --upload-pack option in git methods like clone, fetch, and pull. A patch is available to address this issue.
GitPython versions before 3.1.57 have an incomplete denylist in the unsafe_git_archive_options guard that omits the --add-file and --add-virtual-file options. This allows an attacker to read arbitrary files on the filesystem via the Repo.archive() method when used in kimi-cli, exposing sensitive file contents. The vulnerability does not allow code execution. A patch is available to address this issue by extending the denylist or implementing a safer allowlist.
GitPython versions before 3.1.57 contain vulnerabilities in the IndexFile.checkout() and TagReference.create() methods that allow unsafe forwarding of git command options. This can lead to arbitrary file overwrite and arbitrary file read on the filesystem by an attacker. These issues have a high severity impact and affect multiple versions of GitPython and products bundling it, such as kimi-cli. A patch is available to address these vulnerabilities.
GitPython versions up to 3.1.53 contain an argument injection vulnerability in the Commit.count() method. This method improperly forwards unsafe keyword arguments to the underlying git rev-list command without validation. Specifically, the unchecked --output argument can cause git rev-list to open and truncate arbitrary files to zero bytes, leading to potential data loss. The vulnerability has a medium severity rating and a CVSS score of 5.4.
GitPython versions before 3.1.55 have a vulnerability in the Repo.create_remote() and Remote.add() methods that allows environment variable expansion in URLs. This can lead to sensitive environment variables being exposed if an attacker supplies a URL containing environment variable references. These references get expanded and stored in Git configuration files and then transmitted to an attacker's server during fetch or pull operations. A patch is available to address this issue.
GitPython versions before 3.1.54 have an incomplete denylist for unsafe git clone options in the kimi-cli component, omitting the --template option. This omission allows an attacker who can control clone options and stage a malicious hook directory to execute arbitrary OS commands during a git clone operation. A patch is available that adds --template to the denylist to prevent this attack.
An out-of-bounds read vulnerability exists in the Intel(R) NPU Driver affecting all versions within Ring 3 user applications. This flaw may allow an unprivileged, authenticated local user to cause a denial of service without requiring user interaction or special internal knowledge. The vulnerability impacts system availability with no direct confidentiality impact and low integrity impact.
A protection mechanism failure exists in Intel(R) Neural Compressor software versions before v3.6 that may allow escalation of privilege. The vulnerability requires local access by an unprivileged adversary with a privileged user and low complexity attack conditions. Exploitation may impact confidentiality, integrity, and availability of the affected system. No patch information is provided.
A time-of-check time-of-use (TOCTOU) race condition vulnerability exists in the Intel(R) NPU Driver for Windows within Ring 1. This flaw may allow an unprivileged, authenticated local user to cause a denial of service on the affected system. The attack requires high complexity and no user interaction. The vulnerability impacts system availability with no confidentiality impact and low integrity impact.
A vulnerability in the multicluster-global-hub manager component allows improper validation of the source identity of incoming CloudEvents on Kafka status topics. An attacker who has compromised a managed hub and obtained its Kafka client certificate can manipulate the source identity to falsify or delete critical data such as compliance, inventory, and cluster health information belonging to other hubs. This flaw has a high severity rating with a CVSS score of 8.5. Red Hat has released security advisories with updated versions addressing this issue.