REDHAT-BUG-2456181: High severity Vite Vite vulnerability
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, .crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vite-dev-serverto a version that resolves this vulnerability.Fixed in 7.3.2 - Upgrade
Upgrade
vite-dev-serverto a version that resolves this vulnerability.Fixed in 8.0.5
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2456181?
The severity of REDHAT-BUG-2456181 is classified as high (7).
How do I fix REDHAT-BUG-2456181?
To fix REDHAT-BUG-2456181, upgrade Vite to version 7.3.2 or 8.0.6 or later.
What versions of Vite are affected by REDHAT-BUG-2456181?
Versions of Vite from 7.1.0 to before 7.3.2 and 8.0.5 are affected by REDHAT-BUG-2456181.
What types of files can be exposed due to REDHAT-BUG-2456181?
Files that should be blocked, such as .env and *.crt, can be exposed due to REDHAT-BUG-2456181.
How does REDHAT-BUG-2456181 impact web applications?
REDHAT-BUG-2456181 can lead to unauthorized access of sensitive configuration files in web applications.