CVE-2023-49293

Severity CVSS v4.0:
Pending analysis
Type:
CWE-79 Cross-Site Scripting (XSS)
Publication date:
04/12/2023
Last modified:
08/12/2023

Description

Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original request URL is passed in unmodified, and the `html` being transformed contains inline module scripts (`...`), it is possible to inject arbitrary HTML into the transformed output by supplying a malicious URL query string to `server.transformIndexHtml`. Only apps using `appType: 'custom'` and using the default Vite HTML middleware are affected. The HTML entry must also contain an inline script. The attack requires a user to click on a malicious URL while running the dev server. Restricted files aren't exposed to the attacker. This issue has been addressed in vite@5.0.5, vite@4.5.1, and vite@4.4.12. There are no known workarounds for this vulnerability.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* 4.4.0 (including) 4.4.11 (including)
cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* 5.0.0 (including) 5.0.4 (including)
cpe:2.3:a:vitejs:vite:5.0.0:-:*:*:*:node.js:*:*
cpe:2.3:a:vitejs:vite:5.0.0:beta0:*:*:*:node.js:*:*
cpe:2.3:a:vitejs:vite:5.0.0:beta1:*:*:*:node.js:*:*
cpe:2.3:a:vitejs:vite:5.0.0:beta10:*:*:*:node.js:*:*
cpe:2.3:a:vitejs:vite:5.0.0:beta11:*:*:*:node.js:*:*
cpe:2.3:a:vitejs:vite:5.0.0:beta12:*:*:*:node.js:*:*
cpe:2.3:a:vitejs:vite:5.0.0:beta13:*:*:*:node.js:*:*
cpe:2.3:a:vitejs:vite:5.0.0:beta14:*:*:*:node.js:*:*
cpe:2.3:a:vitejs:vite:5.0.0:beta15:*:*:*:node.js:*:*
cpe:2.3:a:vitejs:vite:5.0.0:beta16:*:*:*:node.js:*:*
cpe:2.3:a:vitejs:vite:5.0.0:beta17:*:*:*:node.js:*:*
cpe:2.3:a:vitejs:vite:5.0.0:beta18:*:*:*:node.js:*:*
cpe:2.3:a:vitejs:vite:5.0.0:beta19:*:*:*:node.js:*:*