{"id":"CVE-2023-49293","published":"2023-12-04T23:03:30Z","modified":"2025-05-29T13:40:53Z","title":"Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite","vendor":"vitejs","product":"vite","tier":"tail","description":{"text":"Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original request URL is passed in unmodified, and the `html` being transformed contains inline module scripts (`<script type=\"module\">...</script>`), it is possible to inject arbitrary HTML into the transformed output by supplying a malicious URL query string to `server.transformIndexHtml`. Only apps using `appType: 'custom'` and using the default Vite HTML middleware are affected. The HTML entry must also contain an inline script. The attack requires a user to click on a malicious URL while running the dev server. Restricted files aren't exposed to the attacker. This issue has been addressed in vite@5.0.5, vite@4.5.1, and vite@4.4.12. There are no known workarounds for this vulnerability.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00997,"percentile":0.62593,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-92r3-m2mg-pj97","tags":["x_refsource_CONFIRM"]}],"priority":{"score":21.8,"factors":[{"name":"EPSS percentile","points":12.52},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":4.27}]},"exploitSources":{"nuclei":[{"id":"CVE-2023-49293","name":"Vite dev server - Cross-Site Scripting","severity":"medium","path":"http/cves/2023/CVE-2023-49293.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-49293.yaml"}],"provenance":"source"},"vendorSlug":"vitejs","affectedVersions":[{"vendor":"vitejs","product":"vite","versions":[">=4.4.0, < 4.4.12","= 4.5.0",">=5.0.0, < 5.0.5"]}],"affected":[{"ecosystem":"npm","package":"vite","vulnerableRanges":[">=4.4.0, <4.4.12",">=4.5.0, <4.5.1",">=5.0.0, <5.0.5"],"patched":["4.4.12","4.5.1","5.0.5"],"from":["GHSA-92r3-m2mg-pj97"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-3168","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-35204","published":"2022-08-18","fixed":"3.0.0-beta.4","kev":false},{"cve":"CVE-2023-34092","published":"2023-06-01","fixed":"4.3.9","kev":false},{"cve":"CVE-2023-49293","published":"2023-12-04","fixed":"5.0.5","kev":false},{"cve":"CVE-2024-23331","published":"2024-01-19","fixed":"5.0.12","kev":false,"link":{"from":"CVE-2023-49293","to":"CVE-2024-23331","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"4.5.1","toFixed":"4.5.2","daysApart":46},{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"5.0.5","toFixed":"5.0.12","daysApart":46}]}},{"cve":"CVE-2024-31207","published":"2024-04-04","fixed":"5.2.6","kev":false},{"cve":"CVE-2024-45811","published":"2024-09-17","fixed":"5.4.6","kev":false}],"package":"npm:vite"}}