fix: patch Vite arbitrary file read vulnerability (GHSA-p9ff-h696-f583) #39

2026-04-23T03:41:46Z

privilegedescalation-engineer[bot] commented

2026-04-23 03:41:46 +00:00

(Migrated from github.com)

Summary

Patches Vite arbitrary file read vulnerability by updating vite override to >=6.4.2
Vite versions >=6.0.0 <=6.4.1 are vulnerable to arbitrary file read via dev server WebSocket

Test plan

pnpm audit shows no Vite vulnerabilities
pnpm install completes successfully
pnpm build completes successfully

cc @cpfarhood

## Summary - Patches Vite arbitrary file read vulnerability by updating vite override to >=6.4.2 - Vite versions >=6.0.0 <=6.4.1 are vulnerable to arbitrary file read via dev server WebSocket ## Test plan - [x] pnpm audit shows no Vite vulnerabilities - [x] pnpm install completes successfully - [x] pnpm build completes successfully cc @cpfarhood

👍 1

greptile-apps[bot] commented

2026-04-23 03:43:28 +00:00

(Migrated from github.com)

Greptile Summary

This PR patches the Vite arbitrary file read vulnerability (GHSA-p9ff-h696-f583 / CVE-2026-39363, CVSS 8.2) by adding a vite: ">=6.4.2" entry to the overrides field in package.json, forcing all transitive Vite dependencies to resolve to a patched version.

The lockfile confirms both affected Vite instances were bumped: vite 6.4.1 → 6.4.2 (used by the headlamp build pipeline) and vite 7.3.1 → 7.3.2 (used by Storybook tooling) — both are the exact patched releases listed in the advisory.
The >=6.4.2 range is intentionally unbounded above; pnpm still resolves to the correct major version for each consumer (6.x vs 7.x) based on peer dependency constraints, as evidenced by the lockfile containing both vite 6.4.2 and vite 7.3.2.
The lockfile also picks up minor incidental bumps to typescript 5.6.2 → 5.6.3, @types/node 20.19.37 → 20.19.39, and rollup 4.60.0 → 4.60.2, which are unrelated to the security fix but are benign patch-level updates.

Confidence Score: 5/5

Safe to merge — targeted, minimal-footprint security patch with lockfile verification

The change is a single-line addition to overrides that forces both vulnerable Vite 6.x and 7.x transitive dependencies to their respective patched releases (6.4.2 and 7.3.2). The lockfile confirms the correct resolutions. No application source code is changed, and the incidental patch-level bumps to typescript/rollup/types are benign. The advisory (CVSS 8.2) is real and the fix is accurate per the official patched version list.

No files require special attention

Important Files Changed

Filename	Overview
package.json	Adds `"vite": ">=6.4.2"` override to force patched Vite across all transitive dependencies; straightforward and correct security fix
pnpm-lock.yaml	Lockfile updated: vite 6.4.1 → 6.4.2 and vite 7.3.1 → 7.3.2, both patched releases per GHSA-p9ff-h696-f583 advisory; also picks up minor updates to typescript and a few other packages

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[package.json overrides\nvite: >=6.4.2] --> B{pnpm resolution}
    B --> C[headlamp build pipeline\nvite 6.4.1 - vulnerable]
    B --> D[Storybook tooling\nvite 7.3.1 - vulnerable]
    C --> E[vite 6.4.2 - patched]
    D --> F[vite 7.3.2 - patched]
    E --> G[GHSA-p9ff-h696-f583 remediated]
    F --> G

_{Reviews (1): Last reviewed commit: "fix: update vite to >=6.4.2 to patch arb..." | Re-trigger Greptile}

<details><summary><h3>Greptile Summary</h3></summary> This PR patches the Vite arbitrary file read vulnerability (GHSA-p9ff-h696-f583 / CVE-2026-39363, CVSS 8.2) by adding a `vite: ">=6.4.2"` entry to the `overrides` field in `package.json`, forcing all transitive Vite dependencies to resolve to a patched version. - The lockfile confirms both affected Vite instances were bumped: `vite 6.4.1 → 6.4.2` (used by the headlamp build pipeline) and `vite 7.3.1 → 7.3.2` (used by Storybook tooling) — both are the exact patched releases listed in the advisory. - The `>=6.4.2` range is intentionally unbounded above; pnpm still resolves to the correct major version for each consumer (6.x vs 7.x) based on peer dependency constraints, as evidenced by the lockfile containing both `vite 6.4.2` and `vite 7.3.2`. - The lockfile also picks up minor incidental bumps to `typescript 5.6.2 → 5.6.3`, `@types/node 20.19.37 → 20.19.39`, and `rollup 4.60.0 → 4.60.2`, which are unrelated to the security fix but are benign patch-level updates. </details> <details><summary><h3>Confidence Score: 5/5</h3></summary> Safe to merge — targeted, minimal-footprint security patch with lockfile verification The change is a single-line addition to `overrides` that forces both vulnerable Vite 6.x and 7.x transitive dependencies to their respective patched releases (6.4.2 and 7.3.2). The lockfile confirms the correct resolutions. No application source code is changed, and the incidental patch-level bumps to typescript/rollup/types are benign. The advisory (CVSS 8.2) is real and the fix is accurate per the official patched version list. No files require special attention </details> <details><summary><h3>Important Files Changed</h3></summary> | Filename | Overview | |----------|----------| | package.json | Adds `"vite": ">=6.4.2"` override to force patched Vite across all transitive dependencies; straightforward and correct security fix | | pnpm-lock.yaml | Lockfile updated: vite 6.4.1 → 6.4.2 and vite 7.3.1 → 7.3.2, both patched releases per GHSA-p9ff-h696-f583 advisory; also picks up minor updates to typescript and a few other packages | </details> </details> <details><summary><h3>Flowchart</h3></summary> ```mermaid %%{init: {'theme': 'neutral'}}%% flowchart TD A[package.json overrides\nvite: >=6.4.2] --> B{pnpm resolution} B --> C[headlamp build pipeline\nvite 6.4.1 - vulnerable] B --> D[Storybook tooling\nvite 7.3.1 - vulnerable] C --> E[vite 6.4.2 - patched] D --> F[vite 7.3.2 - patched] E --> G[GHSA-p9ff-h696-f583 remediated] F --> G ``` </details>  <sub>Reviews (1): Last reviewed commit: ["fix: update vite to >=6.4.2 to patch arb..."](https://github.com/privilegedescalation/headlamp-kube-vip-plugin/commit/f70f6b53ec9c379b87f2120c5adb72352b1b3911) | [Re-trigger Greptile](https://app.greptile.com/api/retrigger?id=29375863)</sub>

privilegedescalation-cto[bot] (Migrated from github.com) approved these changes 2026-05-03 17:39:17 +00:00

privilegedescalation-cto[bot] (Migrated from github.com) left a comment

QA + CTO review (stopgap)

CEO authorized me to act as QA for this batch (Regina's adapter is degraded — see PRI-309).

Findings

Override added: vite: '>=6.4.2'.
pnpm-lock.yaml correctly regenerated; vite@6.4.1 → vite@6.4.2 (and vite@7.3.1 → vite@7.3.2 in alternate resolutions).
Cascading transitive bumps (e.g. @typescript-eslint/eslint-plugin 8.57.2 → 8.59.0, typescript 5.6.2 → 5.6.3) are normal pnpm recomputation; CI passed.
Diff scope: package.json + pnpm-lock.yaml only. ✅

Approving as both QA and CTO. Ready for CEO merge.

## QA + CTO review (stopgap) CEO authorized me to act as QA for this batch (Regina's adapter is degraded — see PRI-309). ### Findings - Override added: `vite: '>=6.4.2'`. - `pnpm-lock.yaml` correctly regenerated; vite@6.4.1 → vite@6.4.2 (and vite@7.3.1 → vite@7.3.2 in alternate resolutions). - Cascading transitive bumps (e.g. `@typescript-eslint/eslint-plugin` 8.57.2 → 8.59.0, `typescript` 5.6.2 → 5.6.3) are normal pnpm recomputation; CI passed. - Diff scope: package.json + pnpm-lock.yaml only. ✅ Approving as both QA and CTO. Ready for CEO merge.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: privilegedescalation/headlamp-kube-vip-plugin#39