chore(deps): update dependency vite to v6.2.5 [security] #839

renovate · 2025-03-30T17:47:06Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
vite (source)	`6.2.1` -> `6.2.5`
vite (source)	`6.2.3` -> `6.2.5`

GitHub Vulnerability Alerts

CVE-2025-30208

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

@fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as ? are removed in several places, but are not accounted for in query string regexes.

PoC

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev

$ echo "top secret content" > /tmp/secret.txt

# expected behaviour
$ curl "http://localhost:5173/@&#8203;fs/tmp/secret.txt"

    <body>
      <h1>403 Restricted</h1>
      <p>The request url &quot;/tmp/secret.txt&quot; is outside of Vite serving allow list.

# security bypassed
$ curl "http://localhost:5173/@&#8203;fs/tmp/secret.txt?import&raw??"
export default "top secret content\n"
//# sourceMappingURL=data:application/json;base64,eyJ2...

CVE-2025-31125

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

base64 encoded content of non-allowed files is exposed using ?inline&import (originally reported as ?import&?inline=1.wasm?init)
content of non-allowed files is exposed using ?raw?import

/@fs/ isn't needed to reproduce the issue for files inside the project root.

PoC

Original report (check details above for simplified cases):

The ?import&?inline=1.wasm?init ending allows attackers to read arbitrary files and returns the file content if it exists. Base64 decoding needs to be performed twice

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev

Example full URL http://localhost:5173/@fs/C:/windows/win.ini?import&?inline=1.wasm?init

CVE-2025-31486

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected..

Details

`.svg`

Requests ending with .svg are loaded at this line.
https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the restriction was able to bypass.

This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+.

relative paths

The check was applied before the id normalization. This allowed requests to bypass with relative paths (e.g. ../../).

PoC

npm create vite@latest
cd vite-project/
npm install
npm run dev

send request to read etc/passwd

curl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init'

curl 'http://127.0.0.1:5173/@&#8203;fs/x/x/x/vite-project/?/../../../../../etc/passwd?import&?raw'

Release Notes

vitejs/vite (vite)

`v6.2.5`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.2.4`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.2.3`

Compare Source

Please refer to CHANGELOG.md for details.

`v6.2.2`

Compare Source

fix: await client buildStart on top level buildStart (#19624) (b31faab), closes #19624
fix(css): inline css correctly for double quote use strict (#19590) (d0aa833), closes #19590
fix(deps): update all non-major dependencies (#19613) (363d691), closes #19613
fix(indexHtml): ensure correct URL when querying module graph (#19601) (dc5395a), closes #19601
fix(preview): use preview https config, not server (#19633) (98b3160), closes #19633
fix(ssr): use optional chaining to prevent "undefined is not an object" happening in `ssrRewriteStac (4309755), closes #19612
feat: show friendly error for malformed base (#19616) (2476391), closes #19616
feat(worker): show asset filename conflict warning (#19591) (367d968), closes #19591
chore: extend commit hash correctly when ambigious with a non-commit object (#19600) (89a6287), closes #19600

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

netlify · 2025-03-30T17:47:55Z

✅ Deploy Preview for vue-devtools-docs canceled.

Name	Link
🔨 Latest commit	`5bab6a0`
🔍 Latest deploy log	https://app.netlify.com/sites/vue-devtools-docs/deploys/67eff9fa8353120008cadc11

pkg-pr-new · 2025-03-30T17:48:54Z

Open in StackBlitz

@vue/devtools-applet

npm i https://pkg.pr.new/@vue/devtools-applet@839

@vue/devtools-core

npm i https://pkg.pr.new/@vue/devtools-core@839

@vue/devtools-api

npm i https://pkg.pr.new/@vue/devtools-api@839

@vue/devtools-kit

npm i https://pkg.pr.new/@vue/devtools-kit@839

@vue/devtools

npm i https://pkg.pr.new/@vue/devtools@839

vite-plugin-vue-devtools

npm i https://pkg.pr.new/vite-plugin-vue-devtools@839

commit: 5bab6a0

renovate bot added the dependencies label Mar 30, 2025

renovate bot force-pushed the renovate/npm-vite-vulnerability branch from 99547bf to 00650fa Compare March 31, 2025 18:43

renovate bot changed the title ~~chore(deps): update dependency vite to v6.2.3 [security]~~ chore(deps): update dependency vite to v6.2.4 [security] Mar 31, 2025

chore(deps): update dependency vite to v6.2.5 [security]

5bab6a0

renovate bot force-pushed the renovate/npm-vite-vulnerability branch from 00650fa to 5bab6a0 Compare April 4, 2025 15:25

renovate bot changed the title ~~chore(deps): update dependency vite to v6.2.4 [security]~~ chore(deps): update dependency vite to v6.2.5 [security] Apr 4, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency vite to v6.2.5 [security] #839

chore(deps): update dependency vite to v6.2.5 [security] #839

renovate bot commented Mar 30, 2025 •

edited

Loading

netlify bot commented Mar 30, 2025 •

edited

Loading

pkg-pr-new bot commented Mar 30, 2025 •

edited

Loading

chore(deps): update dependency vite to v6.2.5 [security] #839

Are you sure you want to change the base?

chore(deps): update dependency vite to v6.2.5 [security] #839

Conversation

renovate bot commented Mar 30, 2025 • edited Loading

GitHub Vulnerability Alerts

CVE-2025-30208

Summary

Impact

Details

PoC

CVE-2025-31125

Summary

Impact

Details

PoC

CVE-2025-31486

Summary

Impact

Details

.svg

relative paths

PoC

Release Notes

v6.2.5

v6.2.4

v6.2.3

v6.2.2

Configuration

netlify bot commented Mar 30, 2025 • edited Loading

✅ Deploy Preview for vue-devtools-docs canceled.

pkg-pr-new bot commented Mar 30, 2025 • edited Loading

renovate bot commented Mar 30, 2025 •

edited

Loading

`.svg`

`v6.2.5`

`v6.2.4`

`v6.2.3`

`v6.2.2`

netlify bot commented Mar 30, 2025 •

edited

Loading

pkg-pr-new bot commented Mar 30, 2025 •

edited

Loading