NIXPKGS-2026-1007
GitHub issue
published on
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse removed package vite
- @LeSuisse removed package vitess
- @LeSuisse removed package vitetris
- @LeSuisse removed package python312Packages.django-vite
- @LeSuisse removed package python313Packages.django-vite
- @LeSuisse removed package python314Packages.django-vite
- @LeSuisse removed package vscode-extensions.vitest.explorer
- @LeSuisse accepted
- @LeSuisse published on GitHub
Vite has a `server.fs.deny` bypass with queries
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
References
-
https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r x_refsource_CONFIRM
Affected products
vite
- ==>= 8.0.0, < 8.0.5
- ==>= 7.1.0, < 7.3.2
vite-plus
- ==< 0.1.16
Matching in nixpkgs
Ignored packages (7)
pkgs.vite
Visual Trace Explorer (ViTE), a tool to visualize execution traces
pkgs.vitess
Database clustering system for horizontal scaling of MySQL
pkgs.vitetris
Terminal-based Tetris clone by Victor Nilsson
pkgs.python312Packages.django-vite
Integration of ViteJS in a Django project
pkgs.python313Packages.django-vite
Integration of ViteJS in a Django project
pkgs.python314Packages.django-vite
Integration of ViteJS in a Django project
pkgs.vscode-extensions.vitest.explorer
Vitest extension for Visual Studio Code