Skip to content

Update dependency vite to v6.1.6 [SECURITY] #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update dependency vite to v6.1.6 [SECURITY] #27

wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Mar 25, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
vite (source) 6.0.9 -> 6.1.6 age confidence

GitHub Vulnerability Alerts

CVE-2025-30208

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

@fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as ? are removed in several places, but are not accounted for in query string regexes.

PoC

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev

$ echo "top secret content" > /tmp/secret.txt

# expected behaviour
$ curl "http://localhost:5173/@​fs/tmp/secret.txt"

    <body>
      <h1>403 Restricted</h1>
      <p>The request url &quot;/tmp/secret.txt&quot; is outside of Vite serving allow list.

# security bypassed
$ curl "http://localhost:5173/@&#8203;fs/tmp/secret.txt?import&raw??"
export default "top secret content\n"
//# sourceMappingURL=data:application/json;base64,eyJ2...

CVE-2025-31125

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

  • base64 encoded content of non-allowed files is exposed using ?inline&import (originally reported as ?import&?inline=1.wasm?init)
  • content of non-allowed files is exposed using ?raw?import

/@&#8203;fs/ isn't needed to reproduce the issue for files inside the project root.

PoC

Original report (check details above for simplified cases):

The ?import&?inline=1.wasm?init ending allows attackers to read arbitrary files and returns the file content if it exists. Base64 decoding needs to be performed twice

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev

Example full URL http://localhost:5173/@&#8203;fs/C:/windows/win.ini?import&?inline=1.wasm?init

CVE-2025-31486

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

.svg

Requests ending with .svg are loaded at this line.
https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the restriction was able to bypass.

This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+.

relative paths

The check was applied before the id normalization. This allowed requests to bypass with relative paths (e.g. ../../).

PoC

npm create vite@latest
cd vite-project/
npm install
npm run dev

send request to read etc/passwd

curl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init'
curl 'http://127.0.0.1:5173/@&#8203;fs/x/x/x/vite-project/?/../../../../../etc/passwd?import&?raw'

CVE-2025-46565

Summary

The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Only files that are under project root and are denied by a file matching pattern can be bypassed.

  • Examples of file matching patterns: .env, .env.*, *.{crt,pem}, **/.env
  • Examples of other patterns: **/.git/**, .git/**, .git/**/*

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns).
These patterns were able to bypass for files under root by using a combination of slash and dot (/.).

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env/. http://localhost:5173

image
image

Release Notes

vitejs/vite (vite)

v6.1.6

Compare Source

Please refer to CHANGELOG.md for details.

v6.1.5

Compare Source

Please refer to CHANGELOG.md for details.

v6.1.4

Compare Source

Please refer to CHANGELOG.md for details.

v6.1.3

Compare Source

Please refer to CHANGELOG.md for details.

v6.1.2

Compare Source

Please refer to CHANGELOG.md for details.

v6.1.1

Compare Source

Features
Bug Fixes
Miscellaneous Chores
Code Refactoring

v6.1.0

Compare Source

Features
Bug Fixes
Miscellaneous Chores
Code Refactoring

v6.0.15

Compare Source

Please refer to CHANGELOG.md for details.

v6.0.14

Compare Source

Please refer to CHANGELOG.md for details.

v6.0.13

Compare Source

Please refer to CHANGELOG.md for details.

v6.0.12

Compare Source

Please refer to CHANGELOG.md for details.

v6.0.11

Compare Source

Features
Bug Fixes
Performance Improvements
Documentation
Code Refactoring
Miscellaneous Chores
Beta Changelogs
6.1.0-beta.2 (2025-02-04)

See 6.1.0-beta.2 changelog

6.1.0-beta.1 (2025-02-04)

See 6.1.0-beta.1 changelog

6.1.0-beta.0 (2025-01-24)

See 6.1.0-beta.0 changelog

v6.0.10

Compare Source

Bug Fixes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions
Copy link

github-actions bot commented Mar 25, 2025 •
edited
Loading

PR Preview Action v1.6.2

🚀 View preview at
https://internetarchive.github.io/iaux-item-metadata/pr/pr-27/

Built to branch gh-pages at 2025-10-21 17:16 UTC.
Preview will be ready when the GitHub Pages deployment is complete.

@codecov-commenter
Copy link

codecov-commenter commented Mar 25, 2025 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.58%. Comparing base (b4fe081) to head (b226266).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main      #27   +/-   ##
=======================================
  Coverage   69.58%   69.58%           
=======================================
  Files          13       13           
  Lines         947      947           
  Branches       24       24           
=======================================
  Hits          659      659           
  Misses        288      288

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate renovate bot changed the title Update dependency vite to v6.0.12 [SECURITY] Update dependency vite to v6.0.13 [SECURITY] Mar 31, 2025
@renovate renovate bot force-pushed the renovate/npm-vite-vulnerability branch from 0abce7d to 01a3e12 Compare March 31, 2025 19:05
@renovate renovate bot changed the title Update dependency vite to v6.0.13 [SECURITY] Update dependency vite to v6.0.14 [SECURITY] Apr 4, 2025
@renovate renovate bot force-pushed the renovate/npm-vite-vulnerability branch from 01a3e12 to e551036 Compare April 4, 2025 17:53
@renovate renovate bot force-pushed the renovate/npm-vite-vulnerability branch from e551036 to 06de2f4 Compare April 30, 2025 23:29
@renovate renovate bot changed the title Update dependency vite to v6.0.14 [SECURITY] Update dependency vite to v6.1.6 [SECURITY] Apr 30, 2025
@renovate renovate bot force-pushed the renovate/npm-vite-vulnerability branch from 06de2f4 to 4987d06 Compare June 6, 2025 00:27
@renovate renovate bot force-pushed the renovate/npm-vite-vulnerability branch from 4987d06 to b074655 Compare June 22, 2025 13:04
@renovate renovate bot force-pushed the renovate/npm-vite-vulnerability branch from b074655 to 6ff6570 Compare July 2, 2025 19:29
@renovate renovate bot force-pushed the renovate/npm-vite-vulnerability branch from 6ff6570 to cd95fae Compare August 10, 2025 12:33
@renovate renovate bot force-pushed the renovate/npm-vite-vulnerability branch from cd95fae to b87ef00 Compare September 25, 2025 14:09
@renovate renovate bot force-pushed the renovate/npm-vite-vulnerability branch from b87ef00 to b226266 Compare October 21, 2025 17:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@codecov-commenter