CVSS 3.1
5.9 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2024-31207
Medium (5.9). EPSS 0.7% chance of exploitation in the next 30 days. Fixed in vite 2.9.18, 3.2.10, 4.5.3.
Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-200, CWE-284
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8jhw-289h-jh2g | npm | vite | >=2.7.0 <2.9.18 | 2.9.18 |
| GHSA-8jhw-289h-jh2g | npm | vite | >=3.0.0 <3.2.10 | 3.2.10 |
| GHSA-8jhw-289h-jh2g | npm | vite | >=4.0.0 <4.5.3 | 4.5.3 |
| GHSA-8jhw-289h-jh2g | npm | vite | >=5.0.0 <5.0.13 | 5.0.13 |
| GHSA-8jhw-289h-jh2g | npm | vite | >=5.1.0 <5.1.7 | 5.1.7 |
| GHSA-8jhw-289h-jh2g | npm | vite | >=5.2.0 <5.2.6 | 5.2.6 |
References
- https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0
- https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48
- https://github.com/vitejs/vite/commit/89c7c645f09d16a38f146ef4a1528f218e844d67
- https://github.com/vitejs/vite/commit/96a7f3a41ef2f9351c46f3ab12489bb4efa03cc9
- https://github.com/vitejs/vite/commit/ba5269cca81de3f5fbb0f49d58a1c55688043258