What is GHSA-859w-5945-r5v3?

GHSA-859w-5945-r5v3 is a security advisory published by GitHub Security Advisories with Medium severity. Vite's server.fs.deny bypassed with /. for files under project root

Which CVE IDs does GHSA-859w-5945-r5v3 cover?

GHSA-859w-5945-r5v3 covers the following CVE IDs: CVE-2025-46565. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-859w-5945-r5v3?

GHSA-859w-5945-r5v3 affects 5 products, including: npm/vite:\u003e= 6.3.0, \u003c= 6.3.3; npm/vite:\u003e= 6.2.0, \u003c= 6.2.6; npm/vite:\u003e= 6.0.0, \u003c= 6.1.5; npm/vite:\u003e= 5.0.0, \u003c= 5.4.18; npm/vite:\u003c= 4.5.13.

GHSA-859w-5945-r5v3Medium

Vite's server.fs.deny bypassed with /. for files under project root

Vendor

GitHub Security Advisories

Published

April 30, 2025

Last Modified

May 2, 2025

🔗 CVE IDs covered (1)

CVE-2025-46565 →

📋 Description

Summary

The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed.

Examples of file matching patterns: .env, .env.*, *.{crt,pem}, **/.env
Examples of other patterns: **/.git/**, .git/**, .git/**/*

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under root by using a combination of slash and dot (/.).

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env/. http://localhost:5173

🎯 Affected products5

npm/vite:>= 6.3.0, <= 6.3.3
npm/vite:>= 6.2.0, <= 6.2.6
npm/vite:>= 6.0.0, <= 6.1.5
npm/vite:>= 5.0.0, <= 5.4.18
npm/vite:<= 4.5.13