Medium · published March 31, 2025
CVSS calls it medium at 5.3. It is confirmed in active exploitation. It sits in the 99.3th percentile for exploit probability.
⚠️ A sneak peek into your files! Vite’s dev server might be exposing sensitive files when certain options are enabled — a highway to your data! Imagine a delivery service that mistakenly leaves packages out in the open, visible to anyone passing by. This vulnerability in Vite could allow unauthorized users to peek at confidential files, just like that careless delivery driver. If you're exposing your Vite dev server to the network, an attacker could exploit this vulnerability to access non-allowed files. This could lead to the leakage of sensitive information or configuration details — absolutely devastating for your application's security!
Imagine a delivery service that mistakenly leaves packages out in the open, visible to anyone passing by. This vulnerability in Vite could allow unauthorized users to peek at confidential files, just like that careless delivery driver. This vulnerability allows attackers to access restricted file content through the Vite server when using the `?inline&import` or `?raw?import` query parameters, specifically on apps that have the server accessible externally.
If you're exposing your Vite dev server to the network, an attacker could exploit this vulnerability to access non-allowed files. This could lead to the leakage of sensitive information or configuration details — absolutely devastating for your application's security! Update to Vite version 6.2.4, 6.1.3, 6.0.13, 5.4.16, or 4.5.11 to patch this vulnerability. Additionally, ensure that your server is not exposed unnecessarily by avoiding the `--host` or `server.host` config options unless absolutely required. You’ve got this! Secure your server and keep that data safe! 🛡️