Executive brief
Vite, a popular frontend build tool and development server, contains an access control weakness that allows attackers to read arbitrary files from the server when the dev server is exposed to the network. An attacker can use specially crafted query parameters (?inline&import or ?raw?import) to bypass file access restrictions and retrieve sensitive file contents. This affects only development setups that explicitly expose the Vite dev server externally (via --host or server.host config).
Technical details
This vulnerability is a CWE-200 (Exposure of Sensitive Information) / CWE-284 (Improper Access Control) issue in Vite's transform middleware. The dev server's file system access checks (server.fs.deny) are bypassed when processing inline or raw query parameters combined with import directives. An attacker network-adjacent to an exposed dev server can craft malicious URLs (e.g., http://localhost:5173/@fs/C:/windows/win.ini?import&?inline=1.wasm?init) to retrieve base64-encoded file contents from the filesystem, including files outside the project root. User interaction is required to trigger the request (e.g., visiting a malicious link), but no authentication is necessary. The fix was committed to Vite's main repository on 2025-03-31 and has been released in patched versions across all affected release lines (4.5.11+, 5.4.16+, 6.0.13+, 6.1.3+, 6.2.4+).
Affected products
- Vitejs Vite < 4.5.11, >= 5.0.0 and < 5.4.16, >= 6.0.0 and < 6.0.13, >= 6.1.0 and < 6.1.3, >= 6.2.0 and < 6.2.4
Timeline
- 2025-03-31: disclosed: Advisory published
- 2025-03-31: patched: Fix committed and patches released across all affected versions