Executive brief
Vite is a JavaScript build tool widely used by web developers. A vulnerability in its development server allows attackers to bypass file access restrictions (server.fs.deny) and read arbitrary files on the system, such as configuration files or private keys. This only affects developers who explicitly expose the dev server to the network, but could allow an attacker with network access to extract sensitive files smaller than 4KB.
Technical details
The vulnerability is an access control bypass (CWE-284/CWE-200) affecting Vite's asset plugin. Two distinct bypasses exist: (1) requests ending in .svg bypass restrictions by appending .wasm?init or sec-fetch-dest: script headers, and (2) relative paths like ../../ bypass the fs.deny check because validation occurs before path normalization. The bypass requires files to be smaller than the build.assetsInlineLimit setting (default 4KB) and only affects Vite 6.0+. An attacker must have network access to the dev server (requires --host or server.host configuration) and can retrieve arbitrary readable files. Patches are available in versions 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.
Affected products
- Vite Vite 0 through 4.5.11, 5.0.0 through 5.4.16, 6.0.0 through 6.0.13, 6.1.0 through 6.1.3, 6.2.0 through 6.2.4
Timeline
- 2025-04-04: disclosed
- 2025-04-04: patched: Fixed in versions 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5