Most recent entries from all

BREW-vite-CVE-2026-39364 — Vite: `server.fs.deny` bypassed with queries

2026-10-03T11:24:52.461074+00:00

Affected: Homebrew: vite

### Summary

The contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser.

### Impact

Only apps that match the following conditions are affected:

- explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) - the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow) - the sensitive file is denied with a pattern that matches a file by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny)

### Details

On the Vite dev server, files that should be blocked by `server.fs.deny` (e.g., `.env`, `*.crt`) can be retrieved with HTTP 200 responses when query parameters such as `?raw`, `?import&raw`, or `?import&url&inline` are appended.

### PoC

1. Start the dev server: `pnpm exec vite root --host 127.0.0.1 --port 5175 --strictPort` 2. Confirm that `server.fs.deny` is enforced (expect 403): `curl -i http://127.0.0.1:5175/src/.env | head -n 20` 3. Confirm that the same files can be retrieved with query parameters (expect 200):

EUVD-2026-354279

2026-10-03T11:24:52.461151+00:00

EUVD-2026-354279

fkie_cve-2026-39364

2026-10-03T11:24:52.461169+00:00

Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.

GHSA-v2wj-q39q-566r — Vite: `server.fs.deny` bypassed with queries

2026-10-03T11:24:52.461196+00:00

Affected: npm: vite

### Summary

The contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser.

### Impact

Only apps that match the following conditions are affected:

### Details

### PoC

RHSA-2026:24866 — Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update

2026-10-03T11:24:52.461234+00:00

axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection Vite: Vite: Information disclosure via WebSocket connection bypasses access control vite: Vite: Information disclosure via query parameter manipulation on the development server cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing LiteLLM: LiteLLM: Arbitrary Code Execution via bytecode rewriting poetry: Poetry: Path traversal vulnerability allows arbitrary file write via malicious package extraction starlette: Starlette: Security restriction bypass via malformed HTTP Host header