CVE-2024-45812

npm/vite CVE-2024-45812: medium 6.4, EPSS 0.64%

Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS

Action: Upgrade vite to 3.2.11 or later.

npm i vite@5.4.6

npm i vite@5.3.6

npm i vite@5.2.14

npm i vite@4.5.4

npm i vite@3.2.11

npm i vite@5.1.8

Affected

Fixed versions

Sources

• osv: GHSA-64vr-g452-qvp3
• https://github.com/vitejs/vite/security/advisories/GHSA-64vr-g452-qvp3
• https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986
• https://nvd.nist.gov/vuln/detail/CVE-2024-45812
• https://github.com/vitejs/vite/commit/179b17773cf35c73ddb041f9e6c703fd9f3126af
• https://github.com/vitejs/vite/commit/2691bb3ff6b073b41fb9046909e1e03a74e36675
• https://github.com/vitejs/vite/commit/2ddd8541ec3b2d2e5b698749e0f2362ef28056bd
• https://github.com/vitejs/vite/commit/ade1d89660e17eedfd35652165b0c26905259fad
• https://github.com/vitejs/vite/commit/e8127166979e7ace6eeaa2c3b733c8994caa31f3
• https://github.com/vitejs/vite/commit/ebb94c5b3bf41950f45562595adec117a4d0ba5e
• https://github.com/vitejs/vite
• https://research.securitum.com/xss-in-amp4email-dom-clobbering
• https://scnps.co/papers/sp23_domclob.pdf

CVE-2024-45812 · published 2024-09-17T19:28:01Z · modified 2026-09-10T03:50:18.740023707Z · JSON