Threats affecting pkg:brew/vite

A vulnerability in Vite allows bypassing the server.fs.deny restriction when using the ?raw?? or ?import&raw?? query parameters, enabling access to arbitrary file contents. This affects Vite dev servers explicitly exposed to the network via the --host option or server.host configuration. The issue arises because trailing separators in the query string are removed inconsistently, allowing unauthorized file reads outside the allowed serving paths. A proof of concept demonstrates reading sensitive files such as /tmp/secret.txt. The vulnerability affects Vite versions from 2.5.1 up to but not including 6.2.3. A patch is available to address this issue. The CVSS score is 5.3 (medium severity).

Vite versions from 2.5.1 up to but not including 6.2.5 have a vulnerability that allows arbitrary file contents to be returned to the browser. This occurs when the Vite development server is exposed to the network using the --host option or server.host configuration. The vulnerability involves bypassing the server.fs.deny restriction via requests ending with .svg or using relative paths before normalization. The issue affects files smaller than the default 4kB inline asset limit in Vite 6.0 and later. Exploitation requires network access to the dev server and user interaction (UI:R).

Vite versions from 2.5.1 up to but not including 6.2.6 have a vulnerability in the dev server's file system access control. When running on Node or Bun runtimes and explicitly exposed to the network, specially crafted HTTP requests with an invalid request-target containing a '#' character can bypass the server.fs.deny check. This allows an attacker to retrieve arbitrary files from the server. The vulnerability does not affect Vite running on Deno due to different URL handling. A proof-of-concept demonstrates reading sensitive files like /etc/passwd via this bypass.