From 917e80994eac23c1114f90304e3710795c399aa2 Mon Sep 17 00:00:00 2001 From: Asianubong Udofia <313439761+uasianubong-droid@users.noreply.github.com> Date: Thu, 15 Oct 2026 06:38:49 +0100 Subject: [PATCH] Improve GHSA-fx2h-pf6j-xcff --- .../2026/06/GHSA-fx2h-pf6j-xcff/GHSA-fx2h-pf6j-xcff.json | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/advisories/github-reviewed/2026/06/GHSA-fx2h-pf6j-xcff/GHSA-fx2h-pf6j-xcff.json b/advisories/github-reviewed/2026/06/GHSA-fx2h-pf6j-xcff/GHSA-fx2h-pf6j-xcff.json index a495727fdc50..20f37c229878 100644 --- a/advisories/github-reviewed/2026/06/GHSA-fx2h-pf6j-xcff/GHSA-fx2h-pf6j-xcff.json +++ b/advisories/github-reviewed/2026/06/GHSA-fx2h-pf6j-xcff/GHSA-fx2h-pf6j-xcff.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-fx2h-pf6j-xcff", - "modified": "2026-07-15T22:05:52Z", + "modified": "2026-07-15T22:05:54Z", "published": "2026-06-15T17:17:45Z", "aliases": [ "CVE-2026-53571" @@ -9,10 +9,6 @@ "summary": "vite: `server.fs.deny` bypass on Windows alternate paths", "details": "### Summary\n\nThe contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser on Windows.\n\n### Impact\n\nOnly apps that match the following conditions are affected:\n\n- explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host))\n- the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow)\n- either of:\n - the sensitive file exists in an NTFS volume\n - the dev server is running on Windows and the sensitive file exists in a volume that 8.3 short name generation is enabled (it is enabled by default on system volumes)\n\n### Details\n\nVite’s dev server denies direct access to sensitive files through `server.fs.deny`, including entries such as `.env`, `.env.*`, and `*.{crt,pem}`. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied.\nBecause of this, requests such as `/.env::$DATA?raw` are treated as allowed paths, while Windows resolves them to the original file's default data stream.\n\nSimilar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them.\n\n### PoC\n```bash\n$ npm create vite@latest\n$ cd vite-project/\n$ npm install\n$ npm run dev\n```\nAccess via browser at `http://localhost:5173/.env::$DATA?raw`\n\"deecc1315123883cfd0f9c26a002845a\"\n\nExample expected result:\n- `/.env::$DATA?raw` returns the contents of `.env`\n- `/tls.pem::$DATA?raw` returns the contents of `tls.pem`", "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" - }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" @@ -87,7 +83,7 @@ }, { "package": { - "ecosystem": "npm", + "ecosystem": "GitHub Actions", "name": "vite-plus" }, "ranges": [