[Security] Bump vite from 6.0.11 to 6.0.14

Dependabotrequested to merge
dependabot-npm_and_yarn-vite-6.0.14 into master

Bumps vite from 6.0.11 to 6.0.14. This update includes security fixes.

Vulnerabilities fixed

Vite bypasses server.fs.deny when using ?raw??

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

@fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as ? are removed in several places, but are not accounted for in query string regexes.

PoC

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev
$ echo "top secret content" > /tmp/secret.txt
expected behaviour
$ curl "http://localhost:5173/@​fs/tmp/secret.txt"
</tr></table>

... (truncated)

Patched versions: 4.5.10; 5.4.15; 6.0.12; 6.1.2; 6.2.3 Affected versions: = 6.2.0, < 6.2.3

Vite has a server.fs.deny bypassed for inline and raw with ?import query

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

  • base64 encoded content of non-allowed files is exposed using ?inline&import (originally reported as ?import&?inline=1.wasm?init)
  • content of non-allowed files is exposed using ?raw?import

/@fs/ isn't needed to reproduce the issue for files inside the project root.

PoC

Original report (check details above for simplified cases):

The ?import&?inline=1.wasm?init ending allows attackers to read arbitrary files and returns the file content if it exists. Base64 decoding needs to be performed twice

</tr></table>

... (truncated)

Patched versions: 4.5.11; 5.4.16; 6.0.13; 6.1.3; 6.2.4 Affected versions: = 6.2.0, < 6.2.4

Vite allows server.fs.deny to be bypassed with .svg or relative paths

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected..

Details

.svg

Requests ending with .svg are loaded at this line. https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290 By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the restriction was able to bypass.

This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+.

relative paths

... (truncated)

Patched versions: 4.5.12; 5.4.17; 6.0.14; 6.1.4; 6.2.5 Affected versions: = 6.2.0, < 6.2.5

Release notes

Sourced from vite's releases.

v6.0.14

Please refer to CHANGELOG.md for details.

v6.0.13

Please refer to CHANGELOG.md for details.

v6.0.12

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.0.14 (2025-04-03)

6.0.13 (2025-03-31)

6.0.12 (2025-03-24)

Commits

Dependabot commands
You can trigger Dependabot actions by commenting on this MR
  • $dependabot recreate will recreate this MR rewriting all the manual changes and resolving conflicts

Merge request reports