fix: update vite to >=6.4.2 to patch arbitrary file read vulnerability (#51)

Vite versions >=6.0.0 <=6.4.1 are vulnerable to arbitrary file read via
the Vite Dev Server WebSocket (server.fs.deny bypass with queries).

CVE: GHSA-p9ff-h696-f583

Co-authored-by: Gandalf the Greybeard <gandalf@privilegedescalation.dev>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This commit was merged in pull request #51.
This commit is contained in:
privilegedescalation-engineer[bot]
2026-05-03 17:44:05 +00:00
committed by GitHub
parent 780f58f9d9
commit 0c2132b013
2 changed files with 1088 additions and 673 deletions
+2 -1
View File
@@ -51,7 +51,8 @@
],
"overrides": {
"tar": "^7.5.11",
"undici": "^7.24.3"
"undici": "^7.24.3",
"vite": ">=6.4.2"
},
"dependencies": {
"node-forge": "^1.4.0"
+1086 -672
View File
File diff suppressed because it is too large Load Diff