CVE-2023-49293
Severity CVSS v4.0:
Pending analysis
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
04/12/2023
Last modified:
08/12/2023
Description
Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original request URL is passed in unmodified, and the `html` being transformed contains inline module scripts (`...`), it is possible to inject arbitrary HTML into the transformed output by supplying a malicious URL query string to `server.transformIndexHtml`. Only apps using `appType: 'custom'` and using the default Vite HTML middleware are affected. The HTML entry must also contain an inline script. The attack requires a user to click on a malicious URL while running the dev server. Restricted files aren't exposed to the attacker. This issue has been addressed in vite@5.0.5, vite@4.5.1, and vite@4.4.12. There are no known workarounds for this vulnerability.
Impact
Base Score 3.x
6.10
Severity 3.x
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* | 4.4.0 (including) | 4.4.11 (including) |
cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* | 5.0.0 (including) | 5.0.4 (including) |
cpe:2.3:a:vitejs:vite:5.0.0:-:*:*:*:node.js:*:* | ||
cpe:2.3:a:vitejs:vite:5.0.0:beta0:*:*:*:node.js:*:* | ||
cpe:2.3:a:vitejs:vite:5.0.0:beta1:*:*:*:node.js:*:* | ||
cpe:2.3:a:vitejs:vite:5.0.0:beta10:*:*:*:node.js:*:* | ||
cpe:2.3:a:vitejs:vite:5.0.0:beta11:*:*:*:node.js:*:* | ||
cpe:2.3:a:vitejs:vite:5.0.0:beta12:*:*:*:node.js:*:* | ||
cpe:2.3:a:vitejs:vite:5.0.0:beta13:*:*:*:node.js:*:* | ||
cpe:2.3:a:vitejs:vite:5.0.0:beta14:*:*:*:node.js:*:* | ||
cpe:2.3:a:vitejs:vite:5.0.0:beta15:*:*:*:node.js:*:* | ||
cpe:2.3:a:vitejs:vite:5.0.0:beta16:*:*:*:node.js:*:* | ||
cpe:2.3:a:vitejs:vite:5.0.0:beta17:*:*:*:node.js:*:* | ||
cpe:2.3:a:vitejs:vite:5.0.0:beta18:*:*:*:node.js:*:* | ||
cpe:2.3:a:vitejs:vite:5.0.0:beta19:*:*:*:node.js:*:* |
To consult the complete list of CPE names with products and versions, see this page