Vite 6.2.4 emerges as a minor version update to the popular Vite build tool, building upon the stable foundation of version 6.2.3. Examining the package metadata reveals subtle yet potentially impactful changes. Both versions share identical core dependencies like Rollup, esbuild, and postcss, ensuring continued compatibility with existing projects. The extensive list of devDependencies remains consistent, indicating no significant shifts in the development toolchain used by the Vite team. This suggests the update concentrates on internal improvements or bug fixes rather than introducing new features or altering fundamental dependencies.
The peerDependencies section, crucial for plugin compatibility, is also unchanged, meaning existing plugins designed for Vite 6.2.3 should function seamlessly with version 6.2.4. This minimizes disruption for developers relying on a rich ecosystem of Vite plugins. Similarly, the optional dependency on fsevents remains, suggesting no platform-specific changes affecting file system event handling.
A minor difference can be found in the dist section, specifically the unpackedSize attribute. Vite v6.2.4 has unpackedSize of 2852380 while the previous version has 2852213, meaning a small increase of 167 bytes. The release date shifting from March 24th to March 31st signifies a week of refinement and stabilization before the update was deemed ready. While difficult to assess the magnitude of the changes only from this data, this update most likely involves bug fixes and minor performance improvements aimed at enhancing the stability and efficiency of the build process. Developers can likely upgrade with confidence, expecting a smoother experience without compatibility issues.
All the vulnerabilities related to the version 6.2.4 of the package
Vite allows server.fs.deny to be bypassed with .svg or relative paths
The contents of arbitrary files can be returned to the browser.
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
.svgRequests ending with .svg are loaded at this line.
https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the restriction was able to bypass.
This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+.
The check was applied before the id normalization. This allowed requests to bypass with relative paths (e.g. ../../).
npm create vite@latest
cd vite-project/
npm install
npm run dev
send request to read etc/passwd
curl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init'
curl 'http://127.0.0.1:5173/@fs/x/x/x/vite-project/?/../../../../../etc/passwd?import&?raw'
Vite has an server.fs.deny bypass with an invalid request-target
The contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun.
Only apps with the following conditions are affected.
HTTP 1.1 spec (RFC 9112) does not allow # in request-target. Although an attacker can send such a request. For those requests with an invalid request-line (it includes request-target), the spec recommends to reject them with 400 or 301. The same can be said for HTTP 2 (ref1, ref2, ref3).
On Node and Bun, those requests are not rejected internally and is passed to the user land. For those requests, the value of http.IncomingMessage.url contains #. Vite assumed req.url won't contain # when checking server.fs.deny, allowing those kinds of requests to bypass the check.
On Deno, those requests are not rejected internally and is passed to the user land as well. But for those requests, the value of http.IncomingMessage.url did not contain #.
npm create vite@latest
cd vite-project/
npm install
npm run dev
send request to read /etc/passwd
curl --request-target /@fs/Users/doggy/Desktop/vite-project/#/../../../../../etc/passwd http://127.0.0.1:5173
Vite's server.fs.deny bypassed with /. for files under project root
The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Only files that are under project root and are denied by a file matching pattern can be bypassed.
.env, .env.*, *.{crt,pem}, **/.env**/.git/**, .git/**, .git/**/*server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns).
These patterns were able to bypass for files under root by using a combination of slash and dot (/.).
npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env/. http://localhost:5173