🚨 [security] Update vite 5.4.19 → 5.4.20 (patch) by depfu[bot] · Pull Request #38 · guibranco/gstraccini-bot-portal

depfu · 2025-09-09T22:25:19Z

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ vite (5.4.19 → 5.4.20) · Repo · Changelog

Security Advisories 🚨

🚨 Vite's `server.fs` settings were not applied to HTML files

Summary

Any HTML files on the machine were served regardless of the server.fs settings.

Impact

Only apps that match the following conditions are affected:

explicitly exposes the Vite dev server to the network (using --host or server.host config option)

appType: 'spa' (default) or appType: 'mpa' is used

This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served.

Details

The serveStaticMiddleware function is in charge of serving static files from the server. It returns the viteServeStaticMiddleware function which runs the needed tests and serves the page. The viteServeStaticMiddleware function checks if the extension of the requested file is ".html". If so, it doesn't serve the page. Instead, the server will go on to the next middlewares, in this case htmlFallbackMiddleware, and then to indexHtmlMiddleware. These middlewares don't perform any test against allow or deny rules, and they don't make sure that the accessed file is in the root directory of the server. They just find the file and send back its contents to the client.

PoC

Execute the following shell commands:
npm  create  vite@latest
cd vite-project/
echo  "secret" > /tmp/secret.html
npm install
npm run dev
Then, in a different shell, run the following command:

curl -v --path-as-is 'http://localhost:5173/../../../../../../../../../../../tmp/secret.html'

The contents of /tmp/secret.html will be returned.

This will also work for HTML files that are in the root directory of the project, but are in the deny list (or not in the allow list). Test that by stopping the running server (CTRL+C), and running the following commands in the server's shell:
echo  'import path from "node:path"; import { defineConfig } from "vite"; export default defineConfig({server: {fs: {deny: [path.resolve(__dirname, "secret_files/*")]}}})'  >  [vite.config.js](http://vite.config.js)
mkdir secret_files
echo "secret txt" > secret_files/secret.txt
echo "secret html" > secret_files/secret.html
npm run dev
Then, in a different shell, run the following command:

curl -v --path-as-is 'http://localhost:5173/secret_files/secret.txt'

You will receive a 403 HTTP Response, because everything in the secret_files directory is denied.

Now in the same shell run the following command:

curl -v --path-as-is 'http://localhost:5173/secret_files/secret.html'

You will receive the contents of secret_files/secret.html.

🚨 Vite middleware may serve files starting with the same name with the public directory

Summary

Files starting with the same name with the public directory were served bypassing the server.fs settings.

Impact

Only apps that match the following conditions are affected:

explicitly exposes the Vite dev server to the network (using --host or server.host config option)

uses the public directory feature (enabled by default)

a symlink exists in the public directory

Details

The servePublicMiddleware function is in charge of serving public files from the server. It returns the viteServePublicMiddleware function which runs the needed tests and serves the page. The viteServePublicMiddleware function checks if the publicFiles variable is defined, and then uses it to determine if the requested page is public. In the case that the publicFiles is undefined, the code will treat the requested page as a public page, and go on with the serving function. publicFiles may be undefined if there is a symbolic link anywhere inside the public directory. In that case, every requested page will be passed to the public serving function. The serving function is based on the sirv library. Vite patches the library to add the possibility to test loading access to pages, but when the public page middleware disables this functionality since public pages are meant to be available always, regardless of whether they are in the allow or deny list.

In the case of public pages, the serving function is provided with the path to the public directory as a root directory. The code of the sirv library uses the join function to get the full path to the requested file. For example, if the public directory is "/www/public", and the requested file is "myfile", the code will join them to the string "/www/public/myfile". The code will then pass this string to the normalize function. Afterwards, the code will use the string's startsWith function to determine whether the created path is within the given directory or not. Only if it is, it will be served.

Since sirv trims the trailing slash of the public directory, the string's startsWith function may return true even if the created path is not within the public directory. For example, if the server's root is at "/www", and the public directory is at "/www/p", if the created path will be "/www/private.txt", the startsWith function will still return true, because the string "/www/private.txt" starts with "/www/p". To achieve this, the attacker will use ".." to ask for the file "../private.txt". The code will then join it to the "/www/p" string, and will receive "/www/p/../private.txt". Then, the normalize function will return "/www/private.txt", which will then be passed to the startsWith function, which will return true, and the processing of the page will continue without checking the deny list (since this is the public directory middleware which doesn't check that).

PoC

Execute the following shell commands:
npm  create  vite@latest
cd vite-project/
mkdir p
cd p
ln -s a b
cd ..
echo  'import path from "node:path"; import { defineConfig } from "vite"; export default defineConfig({publicDir: path.resolve(__dirname, "p/"), server: {fs: {deny: [path.resolve(__dirname, "private.txt")]}}})' > vite.config.js
echo  "secret" > private.txt
npm install
npm run dev
Then, in a different shell, run the following command:

curl -v --path-as-is 'http://localhost:5173/private.txt'

You will receive a 403 HTTP Response, because private.txt is denied.

Now in the same shell run the following command:

curl -v --path-as-is 'http://localhost:5173/../private.txt'

You will receive the contents of private.txt.

Related links

lukeed/sirv@f0113f3

Release Notes

5.4.20

Please refer to CHANGELOG.md for details.

Does any of this look wrong? Please let us know.

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu cancel merge
Cancels automatic merging of this PR

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

Go to the Depfu Dashboard to see the state of your dependencies and to customize how Depfu works.

korbit-ai · 2025-09-09T22:25:26Z

You've used up your 5 PR reviews for this month under the Korbit Starter Plan. You'll get 5 more reviews on October 5th, 2025 or you can upgrade to Pro for unlimited PR reviews and enhanced features in your Korbit Console.

sourcery-ai

Hi @depfu[bot]! 👋

Your private repo does not have access to Sourcery.

Please upgrade to continue using Sourcery ✨

coderabbitai · 2025-09-09T22:25:32Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

guibranco

Automatically approved by gstraccini[bot]

deepsource-io · 2025-09-09T22:25:42Z

Here's the code health analysis summary for commits 2e15220..051b90d. View details on DeepSource ↗.

Analysis Summary

Analyzer	Status	Summary	Link
JavaScript	✅ Success		View Check ↗
Secrets	✅ Success		View Check ↗

💡 If you’re a repository administrator, you can configure the quality gates from the settings.

guibranco · 2025-09-09T22:25:42Z

@depfu merge

socket-security · 2025-09-09T22:25:49Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite@5.4.19 ⏵ 5.4.20	⁺¹	⁺⁹	⁺¹

View full report

socket-security · 2025-09-09T22:25:52Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		`vite@5.4.20` has URL strings. URLs: https://vite.dev/config/server-options.html#server-hmr, http://vite.dev, https://github.com/thlorenz/convert-source-map#upgrading, https://github.com/rich-harris/magic-string, git://github.com/motdotla/dotenv.git, https://dotenvx.com, README.md, dotenvx.com/vault/.env.vault?environment=development, http://www.w3.org/1999/xhtml, http://www.w3.org/1998/Math/MathML, http://www.w3.org/2000/svg, http://www.w3.org/1999/xlink, http://www.w3.org/XML/1998/namespace, http://www.w3.org/2000/xmlns/, http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd, https://example.com, 127.0.0.1, 0.0.0.0 Location: Package overview From: package-lock.json → `npm/vite@5.4.20` ℹ Read more on: This package \| This alert \| What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/vite@5.4.20`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

github-actions · 2025-09-09T22:28:31Z

Infisical secrets check: 🚨 Secrets leaked!

Caution

The Infisical CLI tool found secrets leaked in your repository.
Please review the scan results and take the necessary actions.
Secrets found: 6

💻 Scan logs

A new release of infisical is available: 0.41.90 -> 0.41.99

To update, run: sudo apt-get update && sudo apt-get install infisical

10:28PM INF scanning for exposed secrets...
10:28PM INF 37 commits scanned.
10:28PM INF scan completed in 327ms
10:28PM WRN leaks found: 6

🔎 Detected secrets in your GIT history

RuleID Commit File SymlinkFile Secret Match StartLine EndLine StartColumn EndColumn Author Message Date Email Fingerprint Tags Link

generic-api-key

2e15220

src/mockData.ts

REDACTED

"apiKey: ""REDACTED"""

505

6

41

deepsource-autofix[bot]

"style: format code with Prettier (#35)\n\nThis commit fixes the style issues introduced in f85b623 according to the output\nfrom Prettier.\n\nDetails: None\n\nCo-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>\nCo-authored-by: gstraccini[bot] <150967461+gstraccini[bot]@users.noreply.github.com>\nCo-authored-by: Guilherme Branco Stracini guilherme@guilhermebranco.com.br"

2025-09-04T11:22:37Z

62050782+deepsource-autofix[bot]@users.noreply.github.com

2e15220:src/mockData.ts:generic-api-key:505

gstraccini-bot-portal/src/mockData.ts

Line 505 in 2e15220

apiKey: "sonar_12345678901234567890",

generic-api-key

2e15220

src/pages/Integrations.tsx

REDACTED

"apiKey: ""REDACTED"""

12

8

43

deepsource-autofix[bot]

"style: format code with Prettier (#35)\n\nThis commit fixes the style issues introduced in f85b623 according to the output\nfrom Prettier.\n\nDetails: None\n\nCo-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>\nCo-authored-by: gstraccini[bot] <150967461+gstraccini[bot]@users.noreply.github.com>\nCo-authored-by: Guilherme Branco Stracini guilherme@guilhermebranco.com.br"

2025-09-04T11:22:37Z

62050782+deepsource-autofix[bot]@users.noreply.github.com

2e15220:src/pages/Integrations.tsx:generic-api-key:12

gstraccini-bot-portal/src/pages/Integrations.tsx

Line 12 in 2e15220

apiKey: "sonar_12345678901234567890",

generic-api-key

2e15220

src/pages/RepositoryDetail.tsx

REDACTED

"apiKey: ""REDACTED"""

124

8

43

deepsource-autofix[bot]

"style: format code with Prettier (#35)\n\nThis commit fixes the style issues introduced in f85b623 according to the output\nfrom Prettier.\n\nDetails: None\n\nCo-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>\nCo-authored-by: gstraccini[bot] <150967461+gstraccini[bot]@users.noreply.github.com>\nCo-authored-by: Guilherme Branco Stracini guilherme@guilhermebranco.com.br"

2025-09-04T11:22:37Z

62050782+deepsource-autofix[bot]@users.noreply.github.com

2e15220:src/pages/RepositoryDetail.tsx:generic-api-key:124

gstraccini-bot-portal/src/pages/RepositoryDetail.tsx

Line 124 in 2e15220

apiKey: "sonar_12345678901234567890",

generic-api-key

2e15220

src/pages/RepositoryDetail.tsx

REDACTED

"apiKey: ""REDACTED"""

160

8

44

deepsource-autofix[bot]

"style: format code with Prettier (#35)\n\nThis commit fixes the style issues introduced in f85b623 according to the output\nfrom Prettier.\n\nDetails: None\n\nCo-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>\nCo-authored-by: gstraccini[bot] <150967461+gstraccini[bot]@users.noreply.github.com>\nCo-authored-by: Guilherme Branco Stracini guilherme@guilhermebranco.com.br"

2025-09-04T11:22:37Z

62050782+deepsource-autofix[bot]@users.noreply.github.com

2e15220:src/pages/RepositoryDetail.tsx:generic-api-key:160

gstraccini-bot-portal/src/pages/RepositoryDetail.tsx

Line 160 in 2e15220

apiKey: "codacy_12345678901234567890",

generic-api-key

2e15220

src/pages/RepositoryDetail.tsx

REDACTED

"apiKey: ""REDACTED"""

178

8

42

deepsource-autofix[bot]

"style: format code with Prettier (#35)\n\nThis commit fixes the style issues introduced in f85b623 according to the output\nfrom Prettier.\n\nDetails: None\n\nCo-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>\nCo-authored-by: gstraccini[bot] <150967461+gstraccini[bot]@users.noreply.github.com>\nCo-authored-by: Guilherme Branco Stracini guilherme@guilhermebranco.com.br"

2025-09-04T11:22:37Z

62050782+deepsource-autofix[bot]@users.noreply.github.com

2e15220:src/pages/RepositoryDetail.tsx:generic-api-key:178

gstraccini-bot-portal/src/pages/RepositoryDetail.tsx

Line 178 in 2e15220

apiKey: "snyk_12345678901234567890",

generic-api-key

2e15220

src/pages/Settings.tsx

REDACTED

"apiKey: ""REDACTED"""

127

8

43

deepsource-autofix[bot]

"style: format code with Prettier (#35)\n\nThis commit fixes the style issues introduced in f85b623 according to the output\nfrom Prettier.\n\nDetails: None\n\nCo-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>\nCo-authored-by: gstraccini[bot] <150967461+gstraccini[bot]@users.noreply.github.com>\nCo-authored-by: Guilherme Branco Stracini guilherme@guilhermebranco.com.br"

2025-09-04T11:22:37Z

62050782+deepsource-autofix[bot]@users.noreply.github.com

2e15220:src/pages/Settings.tsx:generic-api-key:127

gstraccini-bot-portal/src/pages/Settings.tsx

Line 127 in 2e15220

apiKey: "sonar_12345678901234567890",

Warning

The above table only displays the first 10 leaked secrets.
You can find the full report here: secrets.csv

🐾 Secrets fingerprint

2e1522054d3009edd4cc682e479341776b266eb0:src/mockData.ts:generic-api-key:505
2e1522054d3009edd4cc682e479341776b266eb0:src/pages/Integrations.tsx:generic-api-key:12
2e1522054d3009edd4cc682e479341776b266eb0:src/pages/RepositoryDetail.tsx:generic-api-key:124
2e1522054d3009edd4cc682e479341776b266eb0:src/pages/RepositoryDetail.tsx:generic-api-key:160
2e1522054d3009edd4cc682e479341776b266eb0:src/pages/RepositoryDetail.tsx:generic-api-key:178
2e1522054d3009edd4cc682e479341776b266eb0:src/pages/Settings.tsx:generic-api-key:127

Tip

If you want to ignore these leaked secrets, add the above fingerprint content to a file named .infisicalignore at the repository root level.

depfu Bot added the depfu label Sep 9, 2025

sourcery-ai Bot reviewed Sep 9, 2025

View reviewed changes

github-actions Bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Sep 9, 2025

guibranco enabled auto-merge (squash) September 9, 2025 22:25

gstraccini Bot added the ☑️ auto-merge Automatic merging of pull requests (gstraccini-bot) label Sep 9, 2025

gstraccini Bot assigned guibranco Sep 9, 2025

gstraccini Bot approved these changes Sep 9, 2025

View reviewed changes

guibranco approved these changes Sep 9, 2025

View reviewed changes

gstraccini Bot added the 🤖 bot Automated processes or integrations label Sep 9, 2025

Update vite to version 5.4.20

051b90d

depfu Bot force-pushed the depfu/update/npm/vite-5.4.20 branch from 03cf70e to 051b90d Compare September 9, 2025 22:27

guibranco disabled auto-merge September 10, 2025 13:24

guibranco merged commit bbc5ea0 into main Sep 10, 2025
13 of 17 checks passed

guibranco deleted the depfu/update/npm/vite-5.4.20 branch September 10, 2025 13:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🚨 [security] Update vite 5.4.19 → 5.4.20 (patch)#38

🚨 [security] Update vite 5.4.19 → 5.4.20 (patch)#38
guibranco merged 1 commit into
mainfrom
depfu/update/npm/vite-5.4.20

depfu Bot commented Sep 9, 2025 •

edited

Loading

Uh oh!

korbit-ai Bot commented Sep 9, 2025

Uh oh!

sourcery-ai Bot left a comment

Uh oh!

coderabbitai Bot commented Sep 9, 2025

Review skipped

Uh oh!

guibranco left a comment

Uh oh!

deepsource-io Bot commented Sep 9, 2025 •

edited

Loading

Analysis Summary

Uh oh!

guibranco commented Sep 9, 2025

Uh oh!

socket-security Bot commented Sep 9, 2025 •

edited

Loading

Uh oh!

socket-security Bot commented Sep 9, 2025 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 9, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

depfu Bot commented Sep 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed?

✳️ vite (5.4.19 → 5.4.20) · Repo · Changelog

🚨 Vite's `server.fs` settings were not applied to HTML files

Summary

Impact

Details

PoC

🚨 Vite middleware may serve files starting with the same name with the public directory

Summary

Impact

Details

PoC

Related links

5.4.20

Uh oh!

korbit-ai Bot commented Sep 9, 2025

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Sep 9, 2025

Review skipped

Uh oh!

guibranco left a comment

Choose a reason for hiding this comment

Uh oh!

deepsource-io Bot commented Sep 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Analysis Summary

Uh oh!

guibranco commented Sep 9, 2025

Uh oh!

socket-security Bot commented Sep 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Sep 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 9, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

depfu Bot commented Sep 9, 2025 •

edited

Loading

deepsource-io Bot commented Sep 9, 2025 •

edited

Loading

socket-security Bot commented Sep 9, 2025 •

edited

Loading

socket-security Bot commented Sep 9, 2025 •

edited

Loading