{"action":"Upgrade vite to 2.9.16 or later.","affected":[{"fixed":"2.9.16","introduced":"0"},{"fixed":"3.2.7","introduced":"3.0.2"},{"fixed":"4.0.5","introduced":"4.0.0"},{"fixed":"4.1.5","introduced":"4.1.0"},{"fixed":"4.2.3","introduced":"4.2.0"},{"fixed":"4.3.9","introduced":"4.3.0"}],"component":"vite","cve_ids":["CVE-2023-34092"],"ecosystem":"npm","epss":0.03152,"exploited":false,"fixed_versions":["2.9.16","3.2.7","4.0.5","4.1.5","4.2.3","4.3.9"],"ghsa_id":"GHSA-353f-5xf4-qw67","id":"tcs_01M5KEVZ0KRQTR4444JERAXTMP","modified_at":"2026-09-10T03:50:01.912023705Z","published_at":"2023-06-06T02:01:39Z","references":["https://osv.dev/vulnerability/GHSA-353f-5xf4-qw67","https://github.com/vitejs/vite/security/advisories/GHSA-353f-5xf4-qw67","https://nvd.nist.gov/vuln/detail/CVE-2023-34092","https://github.com/vitejs/vite/pull/13348","https://github.com/vitejs/vite/commit/813ddd6155c3d54801e264ba832d8347f6f66b32","https://github.com/vitejs/vite","https://security.snyk.io/package/npm/vite/3.2.0-beta.4"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-353f-5xf4-qw67","url":"https://osv.dev/vulnerability/GHSA-353f-5xf4-qw67"}],"summary":"Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)"}