This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [vite](https://vite.dev) ([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`7.3.1` → `7.3.2`](https://renovatebot.com/diffs/npm/vite/7.3.1/7.3.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vite/7.3.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/7.3.1/7.3.2?slim=true) | --- ### Vite: `server.fs.deny` bypassed with queries [CVE-2026-39364](https://nvd.nist.gov/vuln/detail/CVE-2026-39364) / [GHSA-v2wj-q39q-566r](https://redirect.github.com/advisories/GHSA-v2wj-q39q-566r) <details> <summary>More information</summary> #### Details ##### Summary The contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser. ##### Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) - the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow) - the sensitive file is denied with a pattern that matches a file by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) ##### Details On the Vite dev server, files that should be blocked by `server.fs.deny` (e.g., `.env`, `*.crt`) can be retrieved with HTTP 200 responses when query parameters such as `?raw`, `?import&raw`, or `?import&url&inline` are appended. ##### PoC 1. Start the dev server: `pnpm exec vite root --host 127.0.0.1 --port 5175 --strictPort` 2. Confirm that `server.fs.deny` is enforced (expect 403): `curl -i http://127.0.0.1:5175/src/.env | head -n 20` <img width="3944" height="1092" alt="image" src="https://github.com/user-attachments/assets/ecb9f2e0-e08f-4ac7-b194-e0f988c4cd4f" /> 3. Confirm that the same files can be retrieved with query parameters (expect 200): <img width="2014" height="373" alt="image" src="https://github.com/user-attachments/assets/76bc2a6a-44f4-4161-ae47-eab5ae0c04a8" /> #### Severity - CVSS Score: 8.2 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r](https://redirect.github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r) - [https://github.com/vitejs/vite/pull/22160](https://redirect.github.com/vitejs/vite/pull/22160) - [https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff](https://redirect.github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff) - [https://github.com/vitejs/vite/releases/tag/v7.3.2](https://redirect.github.com/vitejs/vite/releases/tag/v7.3.2) - [https://github.com/vitejs/vite/releases/tag/v8.0.5](https://redirect.github.com/vitejs/vite/releases/tag/v8.0.5) - [https://nvd.nist.gov/vuln/detail/CVE-2026-39364](https://nvd.nist.gov/vuln/detail/CVE-2026-39364) - [https://github.com/advisories/GHSA-v2wj-q39q-566r](https://redirect.github.com/advisories/GHSA-v2wj-q39q-566r) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-v2wj-q39q-566r) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket [CVE-2026-39363](https://nvd.nist.gov/vuln/detail/CVE-2026-39363) / [GHSA-p9ff-h696-f583](https://redirect.github.com/advisories/GHSA-p9ff-h696-f583) <details> <summary>More information</summary> #### Details ##### Summary [`server.fs`](https://vite.dev/config/server-options#server-fs-strict) check was not enforced to the `fetchModule` method that is exposed in Vite dev server's WebSocket. ##### Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) - WebSocket is not disabled by `server.ws: false` Arbitrary files on the server (development machine, CI environment, container, etc.) can be exposed. ##### Details If it is possible to connect to the Vite dev server’s WebSocket **without an `Origin` header**, an attacker can invoke `fetchModule` via the custom WebSocket event `vite:invoke` and combine `file://...` with `?raw` (or `?inline`) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., `export default "..."`). The access control enforced in the HTTP request path (such as `server.fs.allow`) is not applied to this WebSocket-based execution path. ##### PoC 1. Start the dev server on the target Example (used during validation with this repository): ```bash pnpm -C playground/alias exec vite --host 0.0.0.0 --port 5173 ``` 2. Confirm that access is blocked via the HTTP path (example: arbitrary file) ```bash curl -i 'http://localhost:5173/@fs/etc/passwd?raw' ``` Result: `403 Restricted` (outside the allow list) <img width="3898" height="1014" alt="image" src="https://github.com/user-attachments/assets/f6593377-549c-45d7-b562-5c19833438af" /> 3. Confirm that the same file can be retrieved via the WebSocket path By connecting to the HMR WebSocket without an `Origin` header and sending a `vite:invoke` request that calls `fetchModule` with a `file://...` URL and `?raw`, the file contents are returned as a JavaScript module. <img width="1049" height="296" alt="image" src="https://github.com/user-attachments/assets/af969f7b-d34e-4af4-8adb-5e2b83b31972" /> <img width="1382" height="955" alt="image" src="https://github.com/user-attachments/assets/6a230d2e-197a-4c9c-b373-d0129756d5d7" /> #### Severity - CVSS Score: 8.2 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583](https://redirect.github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583) - [https://github.com/vitejs/vite/pull/22159](https://redirect.github.com/vitejs/vite/pull/22159) - [https://github.com/vitejs/vite/commit/f02d9fde0b195afe3ea2944414186962fbbe41e0](https://redirect.github.com/vitejs/vite/commit/f02d9fde0b195afe3ea2944414186962fbbe41e0) - [https://github.com/vitejs/vite/releases/tag/v6.4.2](https://redirect.github.com/vitejs/vite/releases/tag/v6.4.2) - [https://github.com/vitejs/vite/releases/tag/v7.3.2](https://redirect.github.com/vitejs/vite/releases/tag/v7.3.2) - [https://github.com/vitejs/vite/releases/tag/v8.0.5](https://redirect.github.com/vitejs/vite/releases/tag/v8.0.5) - [https://nvd.nist.gov/vuln/detail/CVE-2026-39363](https://nvd.nist.gov/vuln/detail/CVE-2026-39363) - [https://github.com/advisories/GHSA-p9ff-h696-f583](https://redirect.github.com/advisories/GHSA-p9ff-h696-f583) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-p9ff-h696-f583) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling [CVE-2026-39365](https://nvd.nist.gov/vuln/detail/CVE-2026-39365) / [GHSA-4w7w-66w2-5vf9](https://redirect.github.com/advisories/GHSA-4w7w-66w2-5vf9) <details> <summary>More information</summary> #### Details ##### Summary Any files ending with `.map` even out side the project can be returned to the browser. ##### Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) - have a sensitive content in files ending with `.map` and the path is predictable ##### Details In Vite v7.3.1, the dev server’s handling of `.map` requests for optimized dependencies resolves file paths and calls `readFile` without restricting `../` segments in the URL. As a result, it is possible to bypass the [`server.fs.strict`](https://vite.dev/config/server-options#server-fs-strict) allow list and retrieve `.map` files located outside the project root, provided they can be parsed as valid source map JSON. ##### PoC 1. Create a minimal PoC sourcemap outside the project root ```bash cat > /tmp/poc.map <<'EOF' {"version":3,"file":"x.js","sources":[],"names":[],"mappings":""} EOF ``` 2. Start the Vite dev server (example) ```bash pnpm -C playground/fs-serve dev --host 127.0.0.1 --port 18080 ``` 3. Confirm that direct `/@fs` access is blocked by `strict` (returns 403) <img width="4004" height="1038" alt="image" src="https://github.com/user-attachments/assets/15a859a8-1dc6-4105-8d58-80527c0dd9ab" /> 4. Inject `../` segments under the optimized deps `.map` URL prefix to reach `/tmp/poc.map` <img width="2790" height="846" alt="image" src="https://github.com/user-attachments/assets/5d02957d-2e6a-4c45-9819-3f024e0e81f2" /> #### Severity - CVSS Score: 6.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9](https://redirect.github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9) - [https://github.com/vitejs/vite/pull/22161](https://redirect.github.com/vitejs/vite/pull/22161) - [https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694](https://redirect.github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694) - [https://github.com/vitejs/vite/releases/tag/v6.4.2](https://redirect.github.com/vitejs/vite/releases/tag/v6.4.2) - [https://github.com/vitejs/vite/releases/tag/v7.3.2](https://redirect.github.com/vitejs/vite/releases/tag/v7.3.2) - [https://github.com/vitejs/vite/releases/tag/v8.0.5](https://redirect.github.com/vitejs/vite/releases/tag/v8.0.5) - [https://nvd.nist.gov/vuln/detail/CVE-2026-39365](https://nvd.nist.gov/vuln/detail/CVE-2026-39365) - [https://github.com/advisories/GHSA-4w7w-66w2-5vf9](https://redirect.github.com/advisories/GHSA-4w7w-66w2-5vf9) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-4w7w-66w2-5vf9) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>vitejs/vite (vite)</summary> ### [`v7.3.2`](https://redirect.github.com/vitejs/vite/releases/tag/v7.3.2) [Compare Source](https://redirect.github.com/vitejs/vite/compare/v7.3.1...v7.3.2) Please refer to [CHANGELOG.md](https://redirect.github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md) for details. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/splunk/addonfactory-ucc-generator).  --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: srv-rr-github-token <94607705+srv-rr-github-token@users.noreply.github.com>