Vite's `server.fs.deny` did not deny requests for patterns with directories

Description

Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.

Scores

EPSS (exploitation in 30 days)

0.71% · top 46% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.

Weakness

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)All about CWE-200 and its CVEs
• CWE-284: Improper Access Control (opens in a new tab)All about CWE-284 and its CVEs

Affected products

• vitejs · vite

  • affected >= 2.7.0, <= 2.9.17
  • affected >= 3.0.0, <= 3.2.8
  • affected >= 4.0.0, <= 4.5.2
  • affected >= 5.0.0, <= 5.0.12
  • affected >= 5.1.0, <= 5.1.6
  • affected >= 5.2.0, <= 5.2.5

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• npmviteGHSA-8jhw-289h-jh2g (opens in a new tab)

References (7)

• https://github.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0 (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48 (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/vitejs/vite/commit/89c7c645f09d16a38f146ef4a1528f218e844d67 (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/vitejs/vite/commit/96a7f3a41ef2f9351c46f3ab12489bb4efa03cc9 (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/vitejs/vite/commit/ba5269cca81de3f5fbb0f49d58a1c55688043258 (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/vitejs/vite/commit/d2db33f7d4b96750b35370c70dd2c35ec3b9b649 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-8jhw-289h-jh2g (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2024-31207](https://trackcve.app/badge/CVE-2024-31207.svg)](https://trackcve.app/cve/CVE-2024-31207)

Record last updated 2 Aug 2024, 01:46 UTC.