Post

We published three security advisories affecting the dev server. Only apps using --host are affected. Update now to the patched versions: - Vite 8.0.5 / 7.3.2 / 6.4.2 - Vite+ 0.1.16 Links to each vulnerability report below.

8/4/26, 5:52 am6 reposts49 likes

Vite

@vite.dev

8 Apr

- github.com/vitejs/vite/... - github.com/vitejs/vite/... - github.com/vitejs/vite/...

github.comArbitrary File Read via Vite Dev Server WebSocket### Summary [`server.fs`](https://vite.dev/config/server-options#server-fs-strict) check was not enforced to the `fetchModule` method that is exposed in Vite dev server's WebSocket. ### Impa...