Loading vulnerability details...
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11. This vulnerability involves weaknesses in
This medium-severity vulnerability could be exploited under certain conditions to compromise security controls or access sensitive information. Should be addressed in a timely manner.
Listed in the CISA Known Exploited Vulnerabilities (KEV) catalog — confirmed exploited in the wild.
Probability of exploitation in the next 30 days · more likely than 99.0% of all CVEs.
Isolate affected systems from untrusted networks until patching is complete
Implement enhanced monitoring for exploitation attempts and unusual behavior