Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2023-49293 — Cross-site Scripting in Vite

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
8.3%
top 7.73%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Vitejs Vite
Timeline
PublishedDec 4
Latest updateDec 5

Description

Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original request URL is passed in unmodified, and the `html` being transformed contains inline module scripts (`...`), it is possible to inject arbitrary HTML into the transformed output by supplying a malicious URL query string to `server.transformIndexHtml`. Only apps using `appType: 'custom'` and using the default Vite HTML middleware are affected. The HTML entry must…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶npmvitejs/vite4.4.0 — 4.4.12+2
▶NVDvitejs/vite4.4.0 — 4.4.11+2
▶CVEListV5vitejs/vite= 4.5.0, >=4.4.0, < 4.4.12, >=5.0.0, < 5.0.5+2

🔴Vulnerability Details

2
OSV
Vite XSS vulnerability in `server.transformIndexHtml` via URL payload↗2023-12-05
▶
GHSA
Vite XSS vulnerability in `server.transformIndexHtml` via URL payload↗2023-12-05
▶

💥Exploits & PoCs

1
Nuclei
Vite dev server - Cross-Site Scripting
▶

📋Vendor Advisories

1
Red Hat
vitejs: XSS vulnerability in `server.transformIndexHtml` via URL payload↗2023-12-05
▶