REDHAT-BUG-2456179: High severity Vite Vite vulnerability
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "..."). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2456179?
The severity of REDHAT-BUG-2456179 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2456179?
To fix REDHAT-BUG-2456179, upgrade Vite to version 6.4.2 or above, or 7.3.2 or above, or 8.0.5 or above.
What is REDHAT-BUG-2456179 about?
REDHAT-BUG-2456179 describes a vulnerability in Vite that allows attackers to invoke fetchModule via WebSocket if allowed without an Origin header.
Which versions of Vite are affected by REDHAT-BUG-2456179?
The affected versions of Vite are from 6.0.0 to before 6.4.2, and versions 7.3.2 and 8.0.5.
What type of attack does REDHAT-BUG-2456179 enable?
REDHAT-BUG-2456179 enables an attacker to exploit the vulnerability by leveraging file://... with a ?raw parameter through the Vite dev server's WebSocket.