vite

vite (latest known version: 9.1.1) has 8 known breaking changes on record, each backed by a source URL.

Actively maintainedLatest known version: 9.1.1npm ↗

Security advisories

GHSA-353f-5xf4-qw67HIGH<2.9.16 || >=3.0.2 <3.2.7 || >=4.0.0 <4.0.5 || >=4.1.0 <4.1.5 || >=4.2.0 <4.2.3 || >=4.3.0 <4.3.9

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

source ↗

GHSA-356w-63v5-8wf4MODERATE>=6.2.0 <6.2.6 || >=6.1.0 <6.1.5 || >=6.0.0 <6.0.15 || >=5.0.0 <5.4.18 || <4.5.13

Vite has an `server.fs.deny` bypass with an invalid `request-target`

source ↗

GHSA-4r4m-qw57-chr8MODERATE>=6.2.0 <6.2.4 || >=6.1.0 <6.1.3 || >=6.0.0 <6.0.13 || >=5.0.0 <5.4.16 || <4.5.11

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

source ↗

GHSA-4w7w-66w2-5vf9MODERATE>=8.0.0 <8.0.5 || >=7.0.0 <7.3.2 || <6.4.2

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

source ↗

GHSA-64vr-g452-qvp3MODERATE>=5.4.0 <5.4.6 || >=5.3.0 <5.3.6 || >=5.2.0 <5.2.14 || >=4.0.0 <4.5.4 || <3.2.11 || >=5.0.0 <5.1.8

Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS

source ↗

GHSA-859w-5945-r5v3MODERATE>=6.3.0 <6.3.4 || >=6.2.0 <6.2.7 || >=6.0.0 <6.1.6 || >=5.0.0 <5.4.19 || <4.5.14

Vite's server.fs.deny bypassed with /. for files under project root

source ↗

GHSA-8jhw-289h-jh2gMODERATE>=2.7.0 <2.9.18 || >=3.0.0 <3.2.10 || >=4.0.0 <4.5.3 || >=5.0.0 <5.0.13 || >=5.1.0 <5.1.7 || >=5.2.0 <5.2.6

Vite's `server.fs.deny` did not deny requests for patterns with directories.

source ↗

GHSA-92r3-m2mg-pj97MODERATE>=4.4.0 <4.4.12 || >=4.5.0 <4.5.1 || >=5.0.0 <5.0.5

Vite XSS vulnerability in `server.transformIndexHtml` via URL payload

source ↗

GHSA-93m4-6634-74q7MODERATE>=7.1.0 <7.1.11 || >=7.0.0 <7.0.8 || >=6.0.0 <6.4.1 || >=2.9.18 <5.4.21 || >=3.2.9 <5.4.21 || >=4.5.3 <5.4.21 || >=5.2.6 <5.4.21

vite allows server.fs.deny bypass via backslash on Windows

source ↗

GHSA-9cwx-2883-4wfxMODERATE>=5.4.0 <5.4.6 || >=5.3.0 <5.3.6 || >=5.2.0 <5.2.14 || >=4.0.0 <4.5.4 || <3.2.11 || >=5.0.0 <5.1.8

Vite's `server.fs.deny` is bypassed when using `?import&raw`

source ↗

GHSA-c24v-8rfc-w8vwHIGH>=2.7.0 <2.9.17 || >=3.0.0 <3.2.8 || >=4.0.0 <4.5.2 || >=5.0.0 <5.0.12

Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

source ↗

GHSA-c27g-q93r-2cwfHIGH<2.9.0 || <5.4.9

launch-editor vulnerable to command injection via the crafted request on Windows

source ↗

GHSA-fx2h-pf6j-xcffHIGH>=8.0.0 <8.0.16 || >=7.0.0 <7.3.5 || <6.4.3 || <0.1.24

vite: `server.fs.deny` bypass on Windows alternate paths

source ↗

GHSA-g4jq-h2w9-997cLOW>=7.1.0 <7.1.5 || >=7.0.0 <7.0.7 || >=6.0.0 <6.3.6 || <5.4.20

Vite middleware may serve files starting with the same name with the public directory

source ↗

GHSA-jqfw-vq24-v9c3LOW>=7.1.0 <7.1.5 || >=7.0.0 <7.0.7 || >=6.0.0 <6.3.6 || <5.4.20

Vite's `server.fs` settings were not applied to HTML files

source ↗

GHSA-mv48-hcvh-8jj8HIGH<2.9.13 || >=3.0.0-alpha.0 <3.0.0-beta.4

Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service

source ↗

GHSA-p9ff-h696-f583HIGH>=8.0.0 <8.0.5 || >=7.0.0 <7.3.2 || >=6.0.0 <6.4.2

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

source ↗

GHSA-v2wj-q39q-566rHIGH>=8.0.0 <8.0.5 || >=7.1.0 <7.3.2

Vite: `server.fs.deny` bypassed with queries

source ↗

GHSA-v6wh-96g9-6wx3MODERATE<2.14.1 || >=8.0.0 <8.0.16 || >=7.0.0 <7.3.5 || <6.4.3 || <0.1.24

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

source ↗

GHSA-vg6x-rcgg-rjx6MODERATE>=6.0.0 <6.0.9 || >=5.0.0 <5.4.12 || <4.5.6

Websites were able to send any requests to the development server and read the response in vite

source ↗

GHSA-x574-m823-4x7wMODERATE>=6.2.0 <6.2.3 || >=6.1.0 <6.1.2 || >=6.0.0 <6.0.12 || >=5.0.0 <5.4.15 || <4.5.10

Vite bypasses server.fs.deny when using ?raw??

source ↗

GHSA-xcj6-pq6g-qj4xMODERATE>=6.2.0 <6.2.5 || >=6.1.0 <6.1.4 || >=6.0.0 <6.0.14 || >=5.0.0 <5.4.17 || <4.5.12

Vite allows server.fs.deny to be bypassed with .svg or relative paths

source ↗

Recent changes

vcreate-vite@9.0.0Breaking

Version create-vite@9.0.0 is a semver-major release over create-vite@8.3.0, but no breaking change was detected in the release notes text - flagged for manual review.

source ↗

v8.0.0Breaking

Version 8.0.0 is a semver-major release over 7.3.6, but no breaking change was detected in the release notes text - flagged for manual review.

source ↗

v7.0.0Breaking

Version 7.0.0 is a semver-major release over create-vite@6.5.0, but no breaking change was detected in the release notes text - flagged for manual review.

source ↗

v6.0.0Breaking

Version 6.0.0 is a semver-major release over create-vite@5.5.5, but no breaking change was detected in the release notes text - flagged for manual review.

source ↗

v5.0.0Breaking

Version 5.0.0 is a semver-major release over 4.5.14, but no breaking change was detected in the release notes text - flagged for manual review.

source ↗

vplugin-legacy@4.0.0Breaking

Version plugin-legacy@4.0.0 is a semver-major release over 3.2.11, but no breaking change was detected in the release notes text - flagged for manual review.

source ↗

vplugin-legacy@3.0.0Breaking

Version plugin-legacy@3.0.0 is a semver-major release over 2.9.18, but no breaking change was detected in the release notes text - flagged for manual review.

source ↗

vplugin-vue-jsx@2.0.0Breaking

Version plugin-vue-jsx@2.0.0 is a semver-major release over plugin-vue@1.10.2, but no breaking change was detected in the release notes text - flagged for manual review.

source ↗

Check what changed for vite since your installed version, live.

Open the playground →