Update dependency vite to v6.1.6 [SECURITY] by renovate[bot] · Pull Request #16 · c4mjs/c4-react

renovate · 2025-03-25T19:52:46Z

This PR contains the following updates:

Package	Change	Age	Confidence
vite (source)	`6.0.9` → `6.1.6`

Vite bypasses server.fs.deny when using ?raw??

CVE-2025-30208 / GHSA-x574-m823-4x7w

More information

Details

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

@fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as ? are removed in several places, but are not accounted for in query string regexes.

PoC

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev

$ echo "top secret content" > /tmp/secret.txt

##### expected behaviour
$ curl "http://localhost:5173/@&#8203;fs/tmp/secret.txt"

    <body>
      <h1>403 Restricted</h1>
      <p>The request url &quot;/tmp/secret.txt&quot; is outside of Vite serving allow list.

##### security bypassed
$ curl "http://localhost:5173/@&#8203;fs/tmp/secret.txt?import&raw??"
export default "top secret content\n"
//# sourceMappingURL=data:application/json;base64,eyJ2...

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

CVE-2025-31125 / GHSA-4r4m-qw57-chr8

More information

Details

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

base64 encoded content of non-allowed files is exposed using ?inline&import (originally reported as ?import&?inline=1.wasm?init)
content of non-allowed files is exposed using ?raw?import

/@fs/ isn't needed to reproduce the issue for files inside the project root.

PoC

Original report (check details above for simplified cases):

The ?import&?inline=1.wasm?init ending allows attackers to read arbitrary files and returns the file content if it exists. Base64 decoding needs to be performed twice

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev

Example full URL http://localhost:5173/@fs/C:/windows/win.ini?import&?inline=1.wasm?init

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Vite allows server.fs.deny to be bypassed with .svg or relative paths

CVE-2025-31486 / GHSA-xcj6-pq6g-qj4x

More information

Details

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

`.svg`

Requests ending with .svg are loaded at this line.
https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the restriction was able to bypass.

This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+.

relative paths

The check was applied before the id normalization. This allowed requests to bypass with relative paths (e.g. ../../).

PoC

npm create vite@latest
cd vite-project/
npm install
npm run dev

send request to read etc/passwd

curl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init'

curl 'http://127.0.0.1:5173/@&#8203;fs/x/x/x/vite-project/?/../../../../../etc/passwd?import&?raw'

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Vite's server.fs.deny bypassed with /. for files under project root

CVE-2025-46565 / GHSA-859w-5945-r5v3

More information

Details

Summary

The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Only files that are under project root and are denied by a file matching pattern can be bypassed.

Examples of file matching patterns: .env, .env.*, *.{crt,pem}, **/.env
Examples of other patterns: **/.git/**, .git/**, .git/**/*

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns).
These patterns were able to bypass for files under root by using a combination of slash and dot (/.).

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env/. http://localhost:5173

Severity

CVSS Score: 6.0 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

vitejs/vite (vite)

`v6.1.6`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.1.5`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.1.4`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.1.3`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.1.2`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.1.1`

Compare Source

Features

add support for injecting debug IDs (#18763) (0ff556a)

Bug Fixes

css: run rewrite plugin if postcss plugin exists (#19371) (bcdb51a)
deps: bump tsconfck (#19375) (746a583)
deps: update all non-major dependencies (#19392) (60456a5)
deps: update all non-major dependencies (#19440) (ccac73d)
ensure .[cm]?[tj]sx? static assets are JS mime (#19453) (e7ba55e)
html: ignore malformed src attrs (#19397) (aff7812)
ignore *.ipv4 address in cert (#19416) (973283b)
worker: fix web worker type detection (#19462) (edc65ea)

Miscellaneous Chores

update 6.1.0 changelog (#19363) (fa7c211)

Code Refactoring

remove custom .jxl mime (#19457) (0c85464)

`v6.1.0`

Compare Source

Features

add support for injecting debug IDs (#18763) (0ff556a)

Bug Fixes

css: run rewrite plugin if postcss plugin exists (#19371) (bcdb51a)
deps: bump tsconfck (#19375) (746a583)
deps: update all non-major dependencies (#19392) (60456a5)
deps: update all non-major dependencies (#19440) (ccac73d)
ensure .[cm]?[tj]sx? static assets are JS mime (#19453) (e7ba55e)
html: ignore malformed src attrs (#19397) (aff7812)
ignore *.ipv4 address in cert (#19416) (973283b)
worker: fix web worker type detection (#19462) (edc65ea)

Miscellaneous Chores

update 6.1.0 changelog (#19363) (fa7c211)

Code Refactoring

remove custom .jxl mime (#19457) (0c85464)

`v6.0.15`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.0.14`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.0.13`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.0.12`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.0.11`

Compare Source

Features

show hosts in cert in CLI (#19317) (a5e306f)
support for env var for defining allowed hosts (#19325) (4d88f6c)
use native runtime to import the config (#19178) (7c2a794)
print port in the logged error message after failed WS connection with EADDRINUSE (#19212) (14027b0)
add support for .jxl (#18855) (57b397c)
add the builtins environment resolve (#18584) (2c2d521)
call Logger for plugin logs in build (#13757) (bf3e410)
css: add friendly errors for IE hacks that are not supported by lightningcss (#19072) (caad985)
export defaultAllowedOrigins for user-land config and 3rd party plugins (#19259) (dc8946b)
expose createServerModuleRunnerTransport (#18730) (8c24ee4)
optimizer: support bun text lockfile (#18403) (05b005f)
reporter: add wasm to the compressible assets regex (#19085) (ce84142)
support async for proxy.bypass (#18940) (a6b9587)
support log related functions in dev (#18922) (3766004)
use module runner to import the config (#18637) (b7e0e42)
worker: support dynamic worker option fields (#19010) (d0c3523)

Bug Fixes

avoid builtStart during vite optimize (#19356) (fdb36e0)
build: fix stale build manifest on watch rebuild (#19361) (fcd5785)
allow expanding env vars in reverse order (#19352) (3f5f2bd)
avoid packageJson without name in resolveLibCssFilename (#19324) (f183bdf)
html: fix css disorder when building multiple entry html (#19143) (e7b4ba3)
css: less [@plugin](https://redirect.github.com/plugin) imports of JS files treated as CSS and rebased (fix #19268) (#19269) (602b373)
deps: update all non-major dependencies (#19296) (2bea7ce)
don't call buildStart hooks for vite optimize (#19347) (19ffad0)
don't call next middleware if user sent response in proxy.bypass (#19318) (7e6364d)
resolve: preserve hash/search of file url (#19300) (d1e1b24)
resolve: warn if node-like builtin was imported when resolve.builtin is empty (#19312) (b7aba0b)
respect top-level server.preTransformRequests (#19272) (12aaa58)
ssr: fix transform error due to export all id scope (#19331) (e28bce2)
ssr: pretty print plugin error in ssrLoadModule (#19290) (353c467)
use nodeLikeBuiltins for ssr.target: 'webworker' without noExternal: true (#19313) (9fc31b6)
change ResolvedConfig type to interface to allow extending it (#19210) (bc851e3)
correctly resolve hmr dep ids and fallback to url (#18840) (b84498b)
deps: update all non-major dependencies (#19190) (f2c07db)
hmr: register inlined assets as a dependency of CSS file (#18979) (eb22a74)
make --force work for all environments (#18901) (51a42c6)
resolve: support resolving TS files by JS extension specifiers in JS files (#18889) (612332b)
ssr: combine empty source mappings (#19226) (ba03da2)
use loc.file from rollup errors if available (#19222) (ce3fe23)
utils: clone RegExp values with new RegExp instead of structuredClone (fix #19245, fix #18875) (#19247) (56ad2be)

Performance Improvements

css: only run postcss when needed (#19061) (30194fa)

Documentation

rephrase browser range and features relation (#19286) (97569ef)
update build.manifest jsdocs (#19332) (4583781)

Code Refactoring

deprecate vite optimize command (#19348) (6e0e3c0)

Miscellaneous Chores

update deprecate links domain (#19353) (2b2299c)
deps: update dependency strip-literal to v3 (#19231) (1172d65)
remove outdated code comment about scanImports not being used in ssr (#19285) (fbbc6da)
unneeded name in lockfileFormats (#19275) (96092cb)

Beta Changelogs

Bug Fixes

try parse server.origin URL (#19241) (2495022)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/npm-vite-vulnerability branch from 7f4f693 to 7ec3fc3 Compare March 31, 2025 22:41

renovate Bot changed the title ~~chore(deps): update dependency vite to v6.0.12 [security]~~ chore(deps): update dependency vite to v6.0.13 [security] Mar 31, 2025

renovate Bot force-pushed the renovate/npm-vite-vulnerability branch from 7ec3fc3 to 350ce7d Compare April 4, 2025 18:59

renovate Bot changed the title ~~chore(deps): update dependency vite to v6.0.13 [security]~~ chore(deps): update dependency vite to v6.0.14 [security] Apr 4, 2025

renovate Bot changed the title ~~chore(deps): update dependency vite to v6.0.14 [security]~~ chore(deps): update dependency vite to v6.1.6 [security] Apr 30, 2025

renovate Bot force-pushed the renovate/npm-vite-vulnerability branch from 350ce7d to 6113d7f Compare April 30, 2025 23:28

renovate Bot force-pushed the renovate/npm-vite-vulnerability branch from 6113d7f to 1148ad0 Compare June 6, 2025 01:40

renovate Bot force-pushed the renovate/npm-vite-vulnerability branch from 1148ad0 to 2e6f599 Compare June 22, 2025 15:27

renovate Bot force-pushed the renovate/npm-vite-vulnerability branch from 2e6f599 to 8c108e1 Compare September 25, 2025 14:02

renovate Bot force-pushed the renovate/npm-vite-vulnerability branch from 8c108e1 to 3ea89ed Compare February 12, 2026 13:06

renovate Bot force-pushed the renovate/npm-vite-vulnerability branch from 3ea89ed to 2a91a64 Compare March 5, 2026 20:52

renovate Bot changed the title ~~chore(deps): update dependency vite to v6.1.6 [security]~~ chore(deps): update dependency vite to v6.1.6 [security] - autoclosed Mar 27, 2026

renovate Bot closed this Mar 27, 2026

renovate Bot deleted the renovate/npm-vite-vulnerability branch March 27, 2026 05:11

renovate Bot changed the title ~~chore(deps): update dependency vite to v6.1.6 [security] - autoclosed~~ chore(deps): update dependency vite to v6.1.6 [security] Mar 30, 2026

renovate Bot reopened this Mar 30, 2026

renovate Bot force-pushed the renovate/npm-vite-vulnerability branch 2 times, most recently from 2a91a64 to bdfb1b7 Compare March 30, 2026 18:06

renovate Bot force-pushed the renovate/npm-vite-vulnerability branch from bdfb1b7 to 699855b Compare April 8, 2026 20:10

renovate Bot changed the title ~~chore(deps): update dependency vite to v6.1.6 [security]~~ Update dependency vite to v6.1.6 [SECURITY] Apr 8, 2026

renovate Bot changed the title ~~Update dependency vite to v6.1.6 [SECURITY]~~ Update dependency vite to v6.1.6 [SECURITY] - autoclosed Apr 27, 2026

renovate Bot closed this Apr 27, 2026

renovate Bot changed the title ~~Update dependency vite to v6.1.6 [SECURITY] - autoclosed~~ Update dependency vite to v6.1.6 [SECURITY] Apr 27, 2026

renovate Bot reopened this Apr 27, 2026

renovate Bot force-pushed the renovate/npm-vite-vulnerability branch 2 times, most recently from 699855b to dfe12b0 Compare April 27, 2026 22:58

renovate Bot force-pushed the renovate/npm-vite-vulnerability branch from dfe12b0 to ddbb6b7 Compare May 12, 2026 10:15

Update dependency vite to v6.1.6 [SECURITY]

b5683b2

renovate Bot force-pushed the renovate/npm-vite-vulnerability branch from ddbb6b7 to b5683b2 Compare May 28, 2026 14:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependency vite to v6.1.6 [SECURITY]#16

Update dependency vite to v6.1.6 [SECURITY]#16
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-vite-vulnerability

renovate Bot commented Mar 25, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Mar 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Vite bypasses server.fs.deny when using ?raw??

Details

Summary

Impact

Details

PoC

Severity

References

Vite has a server.fs.deny bypassed for inline and raw with ?import query

Details

Summary

Impact

Details

PoC

Severity

References

Vite allows server.fs.deny to be bypassed with .svg or relative paths

Details

Summary

Impact

Details

.svg

relative paths

PoC

Severity

References

Vite's server.fs.deny bypassed with /. for files under project root

Details

Summary

Impact

Details

PoC

Severity

References

Release Notes

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

Features

Bug Fixes

Performance Improvements

Documentation

Code Refactoring

Miscellaneous Chores

Beta Changelogs

6.1.0-beta.2 (2025-02-04)

6.1.0-beta.1 (2025-02-04)

6.1.0-beta.0 (2025-01-24)

Bug Fixes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Mar 25, 2025 •

edited

Loading

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

`.svg`