chore(deps): update dependency vite to v6.2.3 [security]#722

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

haoqunjiang merged 1 commit intomainfromrenovate/npm-vite-vulnerability

Mar 25, 2025

Merged

chore(deps): update dependency vite to v6.2.3 [security]#722

haoqunjiang merged 1 commit intomainfromrenovate/npm-vite-vulnerability

Mar 25, 2025

Conversation

Copy link

Contributor

renovatebot commentedMar 25, 2025

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
vite (source)	`6.2.2` ->`6.2.3`

GitHub Vulnerability Alerts

CVE-2025-30208

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using--host orserver.host config option) are affected.

Details

@fs denies access to files outside of Vite serving allow list. Adding?raw?? or?import&raw?? to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as? are removed in several places, but are not accounted for in query string regexes.

PoC

$ npm create vite@latest$cd vite-project/$ npm install$ npm run dev$echo"top secret content"> /tmp/secret.txt# expected behaviour$ curl"http://localhost:5173/@&#8203;fs/tmp/secret.txt"<body><h1>403 Restricted</h1><p>The request url&quot;/tmp/secret.txt&quot; is outside of Vite serving allow list.# security bypassed$ curl"http://localhost:5173/@&#8203;fs/tmp/secret.txt?import&raw??"export default"top secret content\n"//# sourceMappingURL=data:application/json;base64,eyJ2...