Skip to content

chore(deps): update dependency vite to v6.2.3 [security] (v2)#2570

Merged
Legend-Master merged 1 commit intov2from
renovate/v2-npm-vite-vulnerability
Mar 25, 2025
Merged

chore(deps): update dependency vite to v6.2.3 [security] (v2)#2570
Legend-Master merged 1 commit intov2from
renovate/v2-npm-vite-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Mar 25, 2025

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
vite (source) 6.2.0 -> 6.2.3 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-30208

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

@fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as ? are removed in several places, but are not accounted for in query string regexes.

PoC

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev

$ echo "top secret content" > /tmp/secret.txt

# expected behaviour
$ curl "http://localhost:5173/@​fs/tmp/secret.txt"

    <body>
      <h1>403 Restricted</h1>
      <p>The request url &quot;/tmp/secret.txt&quot; is outside of Vite serving allow list.

# security bypassed
$ curl "http://localhost:5173/@&#8203;fs/tmp/secret.txt?import&raw??"
export default "top secret content\n"
//# sourceMappingURL=data:application/json;base64,eyJ2...

Release Notes

vitejs/vite (vite)

v6.2.3

Compare Source

Please refer to CHANGELOG.md for details.

v6.2.2

Compare Source

v6.2.1

Compare Source

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested a review from a team as a code owner March 25, 2025 14:59
@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Mar 25, 2025
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Mar 25, 2025

Updated dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/vite@6.2.0 ➜ 6.2.3 None +5 3.37 MB vitebot

View full report↗︎

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Mar 25, 2025

Package Changes Through 9666e7e

There are 8 changes which include autostart with minor, autostart-js with minor, http with patch, http-js with patch, deep-link with patch, deep-link-js with patch, fs with patch, fs-js with patch

Planned Package Versions

The following package releases are the planned based on the context of changes in this pull request.

package current next
api-example 2.0.23 2.0.24
api-example-js 2.0.19 2.0.20
deep-link-example-js 2.2.0 2.2.1
autostart 2.2.0 2.3.0
autostart-js 2.2.0 2.3.0
deep-link 2.2.0 2.2.1
deep-link-js 2.2.0 2.2.1
fs 2.2.0 2.2.1
fs-js 2.2.0 2.2.1
dialog 2.2.0 2.2.1
dialog-js 2.2.0 2.2.1
http 2.4.2 2.4.3
http-js 2.4.2 2.4.3
persisted-scope 2.2.0 2.2.1
single-instance 2.2.2 2.2.3

Add another change file through the GitHub UI by following this link.

Read about change files or the docs at github.com/jbolda/covector

@Legend-Master Legend-Master merged commit 517a29a into v2 Mar 25, 2025
32 checks passed
@Legend-Master Legend-Master deleted the renovate/v2-npm-vite-vulnerability branch March 25, 2025 15:19
gezihuzi pushed a commit to Hypobenthos/plugins-workspace that referenced this pull request Jun 22, 2025
@renovate @gezihuzi
chore(deps): update dependency vite to v6.2.3 [security] (tauri-apps#…
01b955c 
…2570)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Legend-Master Legend-Master Legend-Master approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Legend-Master