Executive brief
Vite is a build tool and development server for JavaScript applications. When Vite's HTML transformation function is called manually with an unmodified request URL containing inline scripts, attackers can inject arbitrary JavaScript into the page by crafting a malicious URL. This vulnerability primarily affects development servers using custom app types and requires a user to click a specially crafted link, but could lead to account compromise or unauthorized actions in dev environments.
Technical details
This is a reflected XSS vulnerability (CWE-79) in Vite's HTML transformation pipeline. When `server.transformIndexHtml` is called with an unmodified request URL (as documented in SSR guides) and the HTML contains inline module scripts, Vite transforms these scripts into proxy script tags with dynamically generated paths. An attacker can break out of the script src attribute by injecting a malicious URL query string (e.g., `?"%3E%3C/script%3E%3Cscript%3Ealert('boom')</script>`), causing arbitrary HTML/JavaScript to be injected into the transformed output. The vulnerability affects apps using `appType: 'custom'` with the default Vite HTML middleware and requires user interaction (clicking a malicious link). Patched in vite 4.4.12, 4.5.1, and 5.0.5.
Affected products
- Vite Vite >=4.4.0 <4.4.12, 4.5.0, >=5.0.0 <5.0.5
Timeline
- 2023-12-04: disclosed
- 2023-12-05: patched: Fixed in vite@4.4.12, vite@4.5.1, vite@5.0.5