CVE-2024-31207
Fixed in a distro release EPSS <1%CVSS 5.9
Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.
Products: vitejs vite
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | vite | 2.9.18 |
| npm | vite | 3.2.10 |
| npm | vite | 4.5.3 |
| npm | vite | 5.0.13 |
| npm | vite | 5.1.7 |
| npm | vite | 5.2.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| openSUSE Tumbleweed | velociraptor | 0.7.0.4.git142.862ef23-1.1 |