A DOM Clobbering vulnerability in Vite affects bundled scripts built with output formats cjs, iife, or umd. This flaw allows an attacker to manipulate the document.currentScript property by injecting a scriptless HTML element named 'currentScript', causing the application to load attacker-controlled scripts dynamically. This can lead to cross-site scripting (XSS) in web pages that include vulnerable Vite bundles and allow embedding of such HTML elements. The vulnerability impacts Vite versions from 2.5.1 up to but not including 5.4.6. A fix is available.