Vite: `server.fs.deny` bypassed with queries
Affected releases · vite
- 8.x8.0.0 – 8.0.4Fixed in 8.0.5
- 7.x7.1.0 – 7.3.1Fixed in 7.3.2
On 8.x, the newest line:
npm install vite@8.0.5Affected
8.0.0 – 8.0.4
5 releases
Fixed
8.0.5 – 8.3.5
29 releases, latest
Not affected
7.0.0 – 7.0.8
9 releases
Affected
7.1.0 – 7.3.1
22 releases
Fixed
7.3.2 – 7.3.7
5 releases
Is your project affected?
Paste your package.json, or type the range you declare for vite. It is read in your browser and sent nowhere.
What happens
Summary
The contents of files that are specified by server.fs.deny can be returned to the browser.
Impact
Only apps that match the following conditions are affected:
explicitly exposes the Vite dev server to the network (using
--hostorserver.hostconfig option)the sensitive file exists in the allowed directories specified by
server.fs.allowthe sensitive file is denied with a pattern that matches a file by
server.fs.deny
Details
On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended.
PoC
Start the dev server:
pnpm exec vite root --host 127.0.0.1 --port 5175 --strictPortConfirm that
server.fs.denyis enforced (expect 403):curl -i http://127.0.0.1:5175/src/.env | head -n 20Confirm that the same files can be retrieved with query parameters (expect 200):