Executive brief
Vite is a popular build tool used to bundle JavaScript applications for the web. When configured to output bundles in CommonJS, IIFE, or UMD formats, Vite generates code vulnerable to DOM Clobbering attacks—a technique where an attacker injects innocent-looking HTML elements (like image tags) that trick the bundled script into loading malicious scripts from attacker-controlled servers. This can result in cross-site scripting (XSS) and compromise of user sessions and data.
Technical details
The vulnerability is a DOM Clobbering gadget in Vite's asset URL resolution mechanism. When building with cjs/iife/umd output formats and dynamic imports of assets, Vite uses `document.currentScript` to resolve asset URLs. An attacker can shadow this lookup via the browser's named DOM element access—by injecting an HTML element (e.g., `<img name="currentScript">`) with a malicious `src` attribute, the bundled code uses that element's `src` as the script URL instead. This requires the ability to inject scriptless HTML (via markdown renderers, comment sections, or HTML injection vulnerabilities in third-party JS). No user interaction or authentication is required beyond the initial HTML injection capability. Patches are available in Vite 5.4.6, 5.3.6, 5.2.14, 5.1.8, 4.5.5, and 3.2.11.
Affected products
- Vite Vite >=5.4.0, <=5.4.5; >=5.3.0, <=5.3.5; >=5.1.0, <=5.2.13; >=5.0.0, <=5.1.7; >=4.0.0, <=4.5.3; <=3.2.10
Timeline
- 2024-09-17: disclosed
- 2024-09-17: patched: Patches available: 5.4.6, 5.3.6, 5.2.14, 5.1.8, 4.5.5, 3.2.11