GHSA-xcj6-pq6g-qj4x Vite allows server.fs.deny to be bypassed with .svg or relative paths

• npm vite: >= 6.2.0, < 6.2.5 → fixed in 6.2.5 • npm vite: >= 6.1.0, < 6.1.4 → fixed in 6.1.4 • npm vite: >= 6.0.0, < 6.0.14 → fixed in 6.0.14 • npm vite: >= 5.0.0, < 5.4.17 → fixed in 5.4.17 • npm vite: < 4.5.12 → fixed in 4.5.12

Summary The contents of arbitrary files can be returned to the browser. Impact Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Details `.svg` Requests ending with `.svg` are loaded at this line. https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290 By adding `?.svg` with `?.wasm?init` or with `sec-fetch-dest: script` header, the restriction was able to bypass. This bypass is only possible if the file is smaller than `build.assetsInlineLimit` (default: 4kB) and when using Vite 6.0+. relative paths The check was applied before the id normalization. This allowed requests to bypass with relative paths (e.g. `../../`). PoC ```bash npm create vite@latest cd vite-project/ npm install npm run dev ``` send request to read `etc/passwd` ```bash curl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init' ``` ```bash curl 'http://127.0.0.1:5173/@fs/x/x/x/vite-project/?/../../../../../etc/passwd?import&?raw' ```