Packages / vite / Security

HighVulnerabilityGHSA-mv48-hcvh-8jj8CVE-2022-35204Published 19 Aug 2022

Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service

Affected releases · vite

  • 2.x2.0.0 – 2.9.12Fixed in 2.9.13
  • 0.20.x and older0.1.0 – 0.20.10No fix, no longer updated

On 2.x, the newest line:

npm install vite@2.9.13
8.x

  1. Not affected

    8.0.0 – 8.3.5

    34 releases, latest

2.x

  1. Affected

    2.0.0 – 2.9.12

    91 releases

  2. Fixed

    2.9.13 – 2.9.18

    6 releases

0.x

  1. Affected

    0.1.0 – 0.20.10

    78 releases

440 stable releases of vite, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for vite. It is read in your browser and sent nowhere.

What happens

Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service.