Vite Request-Target Bypass Vulnerability Allowing Arbitrary File Access

A vulnerability in Vite, a frontend tooling framework for JavaScript, allows the contents of arbitrary files to be accessed through the browser. This issue affects Vite versions 6.2.0 prior to 6.2.6, 6.1.0 prior to 6.1.5, 6.0.0 prior to 6.0.15, 5.0.0 prior to 5.4.18, and 4.5.0 prior to 4.5.13. The vulnerability arises when the development server is exposed to the network and running on Node or Bun, bypassing the 'server.fs.deny' check by exploiting an invalid request-target that includes a '#' character, which is not allowed by HTTP specifications.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server, such as the passwd file in Unix-based systems.

Reproduction

To reproduce this vulnerability, create a new Vite project and run the development server while explicitly exposing it to the network. Then, send a request that includes a '#' in the request-target to bypass the file system denial check and access arbitrary files.

Remediation

Users can update to Vite versions 6.2.6, 6.1.5, 6.0.15, 5.4.18, or 4.5.13 to address this vulnerability.