Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-mbnq-b7vj-jyhb
Vulnerability ID VCID-mbnq-b7vj-jyhb
Aliases CVE-2024-23331
GHSA-c24v-8rfc-w8vw
Summary Improper Access Control Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems. Since `picomatch` defaults to case-sensitive glob matching, but the file server does not discriminate; a block list bypass is possible. By requesting raw filesystem paths using augmented casing, the matcher derived from `config.server.fs.deny` fails to block access to sensitive files. This issue has been addressed in vite@5.0.12, vite@4.5.2, vite@3.2.8, and vite@2.9.17. Users are advised to upgrade. Users unable to upgrade should restrict access to dev servers.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-178 Improper Handling of Case Sensitivity
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-284 Improper Access Control
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
There are no known severity scores.
Reference id Reference type URL
https://github.com/vitejs/vite/commit/0cd769c279724cf27934b1270fbdd45d68217691
https://github.com/vitejs/vite/commit/91641c4da0a011d4c5352e88fc68389d4e1289a5
https://github.com/vitejs/vite/commit/a26c87d20f9af306b5ce3ff1648be7fa5146c278
https://github.com/vitejs/vite/commit/eeec23bbc9d476c54a3a6d36e78455867185a7cb
https://vitejs.dev/config/server-options.html#server-fs-deny
CVE-2023-34092 https://nvd.nist.gov/vuln/detail/CVE-2023-34092
CVE-2024-23331 https://nvd.nist.gov/vuln/detail/CVE-2024-23331
GHSA-c24v-8rfc-w8vw https://github.com/advisories/GHSA-c24v-8rfc-w8vw
GHSA-c24v-8rfc-w8vw https://github.com/vitejs/vite/security/advisories/GHSA-c24v-8rfc-w8vw
No exploits are available.
There are no known vectors.

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-02T04:46:52.271520+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/vite/CVE-2024-23331.yml 38.6.0