-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vite | npm | >= 5.4.0, <= 5.4.5 | 5.4.6 |
| vite | npm | >= 5.3.0, <= 5.3.5 | 5.3.6 |
| vite | npm | >= 4.0.0, <= 4.5.3 | 4.5.4 |
| vite | npm | <= 3.2.10 | 3.2.11 |
| vite | npm | >= 5.2.0, < 5.2.14 | 5.2.14 |
| vite | npm | >= 5.0.0, <= 5.1.7 | 5.1.8 |
Miggo AIRoot Cause AnalysisThe vulnerability occurs because requests with ?import&raw queries bypassed fs.deny protections. The commit diff shows the fix added a check in transformMiddleware using ensureServingAccess for URLs matching rawRE/urlRE. Prior to this fix, transformMiddleware handled these requests without performing the access control check. The ensureServingAccess function (now exported from static.ts) was not being called in this code path before the patch, making transformMiddleware the vulnerable entry point.