Executive brief
Vite is a popular build tool and development server used by web developers to run and test web applications locally. A vulnerability in its default configuration allows any malicious website to send requests to a developer's local Vite server and read the responses—even when the server is not exposed to the network. This could expose application source code, configuration files, and sensitive information being transmitted during development to attackers who trick users into visiting compromised websites.
Technical details
The vulnerability stems from three distinct weaknesses: (1) permissive default CORS headers (Access-Control-Allow-Origin: *) allowing cross-origin fetch requests from any website, (2) lack of Origin header validation on WebSocket connections, enabling Cross-Site WebSocket Hijacking (CSWSH) attacks to intercept HMR (hot module replacement) messages, and (3) missing Host header validation on HTTP requests, facilitating DNS rebinding attacks. An attacker can serve a malicious webpage that, when visited by a developer, executes JavaScript to fetch files from http://127.0.0.1:5173 or establish WebSocket connections, reading source code, error details, and HMR traffic. Affected versions include Vite 4.x ≤4.5.5, 5.0.0–5.4.11, and 6.0.0–6.0.8. Patches are available in 4.5.6+, 5.4.12+, and 6.0.9+.
Affected products
- Vite Vite >=4.0.0,<=4.5.5; >=5.0.0,<=5.4.11; >=6.0.0,<=6.0.8
Timeline
- 2025-01-21: disclosed
- 2025-01-21: patched: Vite 4.5.6, 5.4.12, 6.0.9+ released