Threats tagged 'brew-vite-cve-2025-32395'

Vite versions from 2.5.1 up to but not including 6.2.6 have a vulnerability in the dev server's file system access control. When running on Node or Bun runtimes and explicitly exposed to the network, specially crafted HTTP requests with an invalid request-target containing a '#' character can bypass the server.fs.deny check. This allows an attacker to retrieve arbitrary files from the server. The vulnerability does not affect Vite running on Deno due to different URL handling. A proof-of-concept demonstrates reading sensitive files like /etc/passwd via this bypass.