GHSA-4w7w-66w2-5vf9 Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

• npm vite: >= 8.0.0, < 8.0.5 → fixed in 8.0.5 • npm vite: >= 7.0.0, < 7.3.2 → fixed in 7.3.2 • npm vite: < 6.4.2 → fixed in 6.4.2

Summary Any files ending with `.map` even out side the project can be returned to the browser. Impact Only apps that match the following conditions are affected: • explicitly exposes the Vite dev server to the network (using `--host` or `server.host` config option) • have a sensitive content in files ending with `.map` and the path is predictable Details In Vite v7.3.1, the dev server’s handling of `.map` requests for optimized dependencies resolves file paths and calls `readFile` without restricting `../` segments in the URL. As a result, it is possible to bypass the `server.fs.strict` allow list and retrieve `.map` files located outside the project root, provided they can be parsed as valid source map JSON. PoC 1. Create a minimal PoC sourcemap outside the project root ```bash cat > /tmp/poc.map 4. Inject `../` segments under the optimized deps `.map` URL prefix to reach `/tmp/poc.map`