[Security] Bump vite from 6.0.11 to 6.0.15

Bumps vite from 6.0.11 to 6.0.15. This update includes security fixes.

Vulnerabilities fixed

Vite bypasses server.fs.deny when using ?raw??

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

@fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as ? are removed in several places, but are not accounted for in query string regexes.

PoC

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev
$ echo "top secret content" > /tmp/secret.txt
expected behaviour
$ curl "http://localhost:5173/@​fs/tmp/secret.txt"
</tr></table>

... (truncated)

Patched versions: 4.5.10; 5.4.15; 6.0.12; 6.1.2; 6.2.3 Affected versions: = 6.2.0, < 6.2.3

Vite has a server.fs.deny bypassed for inline and raw with ?import query

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

• base64 encoded content of non-allowed files is exposed using ?inline&import (originally reported as ?import&?inline=1.wasm?init)
• content of non-allowed files is exposed using ?raw?import

/@fs/ isn't needed to reproduce the issue for files inside the project root.

PoC

Original report (check details above for simplified cases):

The ?import&?inline=1.wasm?init ending allows attackers to read arbitrary files and returns the file content if it exists. Base64 decoding needs to be performed twice

</tr></table> 

... (truncated)

Patched versions: 4.5.11; 5.4.16; 6.0.13; 6.1.3; 6.2.4 Affected versions: = 6.2.0, < 6.2.4

Vite allows server.fs.deny to be bypassed with .svg or relative paths

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected..

Details

.svg

Requests ending with .svg are loaded at this line. https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290 By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the restriction was able to bypass.

This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+.

relative paths

... (truncated)

Patched versions: 4.5.12; 5.4.17; 6.0.14; 6.1.4; 6.2.5 Affected versions: = 6.2.0, < 6.2.5

Vite has an server.fs.deny bypass with an invalid request-target

Summary

The contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun.

Impact

Only apps with the following conditions are affected.

• explicitly exposing the Vite dev server to the network (using --host or server.host config option)
• running the Vite dev server on runtimes that are not Deno (e.g. Node, Bun)

Details

HTTP 1.1 spec (RFC 9112) does not allow # in request-target. Although an attacker can send such a request. For those requests with an invalid request-line (it includes request-target), the spec recommends to reject them with 400 or 301. The same can be said for HTTP 2 (ref1, ref2, ref3).

On Node and Bun, those requests are not rejected internally and is passed to the user land. For those requests, the value of http.IncomingMessage.url contains #. Vite assumed req.url won't contain # when checking server.fs.deny, allowing those kinds of requests to bypass the check.

On Deno, those requests are not rejected internally and is passed to the user land as well. But for those requests, the value of http.IncomingMessage.url did not contain #.

PoC

npm create vite@latest
</tr></table> 

... (truncated)

Patched versions: 4.5.13; 5.4.18; 6.0.15; 6.1.5; 6.2.6 Affected versions: = 6.2.0, < 6.2.6

Release notes

Sourced from vite's releases.

v6.0.15

Please refer to CHANGELOG.md for details.

v6.0.14

Please refer to CHANGELOG.md for details.

v6.0.13

Please refer to CHANGELOG.md for details.

v6.0.12

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.0.15 (2025-04-10)

• fix: reject requests with # in request-target (#19830) (6c7debf), closes #19830

6.0.14 (2025-04-03)

• fix: backport #19782, fs check with svg and relative paths (48ee91d), closes #19782

6.0.13 (2025-03-31)

• fix: fs check in transform middleware (#19761) (1487f39), closes #19761

6.0.12 (2025-03-24)

• fix: fs raw query with query separators (#19702) (92ca12d), closes #19702

Commits

• e350468 release: v6.0.15
• 6c7debf fix: reject requests with # in request-target (#19830)
• f678baa release: v6.0.14
• 48ee91d fix: backport #19782, fs check with svg and relative paths
• 0eaadcf release: v6.0.13
• 1487f39 fix: fs check in transform middleware (#19761)
• 9d981f9 release: v6.0.12
• 92ca12d fix: fs raw query with query separators (#19702)
• See full diff in compare view

---

Dependabot commands

You can trigger Dependabot actions by commenting on this MR

• $dependabot recreate will recreate this MR rewriting all the manual changes and resolving conflicts

added dependencies javascript security labels

added severity:moderate label

mentioned in merge request !109 (closed)

closed

Dependabot won't notify anymore about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.