npm

vite

22 Total advisories

22 Vulnerabilities

0 Malware

Dependency scanning

Check whether vite is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

vite

Vulnerabilities

launch-editor vulnerable to command injection via the crafted request on Windows

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

Vite has an `server.fs.deny` bypass with an invalid `request-target`

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

vite: `server.fs.deny` bypass on Windows alternate paths

Vite: `server.fs.deny` bypassed with queries

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

vite allows server.fs.deny bypass via backslash on Windows

Vite's `server.fs` settings were not applied to HTML files

Vite middleware may serve files starting with the same name with the public directory

Vite's server.fs.deny bypassed with /. for files under project root

Vite bypasses server.fs.deny when using ?raw??

Websites were able to send any requests to the development server and read the response in vite

Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS

Vite's `server.fs.deny` is bypassed when using `?import&raw`

Vite's `server.fs.deny` did not deny requests for patterns with directories.

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

Vite allows server.fs.deny to be bypassed with .svg or relative paths

Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service

Vite XSS vulnerability in `server.transformIndexHtml` via URL payload

Browse more npm advisories

Start Securing