{"action":"Upgrade vite to 3.2.11 or later.","affected":[{"fixed":"5.4.6","introduced":"5.4.0"},{"fixed":"5.3.6","introduced":"5.3.0"},{"fixed":"5.2.14","introduced":"5.2.0"},{"fixed":"4.5.4","introduced":"4.0.0"},{"fixed":"3.2.11","introduced":"0"},{"fixed":"5.1.8","introduced":"5.0.0"}],"component":"vite","cve_ids":["CVE-2024-45812"],"ecosystem":"npm","epss":0.00636,"exploited":false,"fixed_versions":["5.4.6","5.3.6","5.2.14","4.5.4","3.2.11","5.1.8"],"ghsa_id":"GHSA-64vr-g452-qvp3","id":"tcs_01M5KF5M3AX4DZDG3KZA73RVV7","modified_at":"2026-09-10T03:50:18.740023707Z","published_at":"2024-09-17T19:28:01Z","references":["https://osv.dev/vulnerability/GHSA-64vr-g452-qvp3","https://github.com/vitejs/vite/security/advisories/GHSA-64vr-g452-qvp3","https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986","https://nvd.nist.gov/vuln/detail/CVE-2024-45812","https://github.com/vitejs/vite/commit/179b17773cf35c73ddb041f9e6c703fd9f3126af","https://github.com/vitejs/vite/commit/2691bb3ff6b073b41fb9046909e1e03a74e36675","https://github.com/vitejs/vite/commit/2ddd8541ec3b2d2e5b698749e0f2362ef28056bd","https://github.com/vitejs/vite/commit/ade1d89660e17eedfd35652165b0c26905259fad","https://github.com/vitejs/vite/commit/e8127166979e7ace6eeaa2c3b733c8994caa31f3","https://github.com/vitejs/vite/commit/ebb94c5b3bf41950f45562595adec117a4d0ba5e","https://github.com/vitejs/vite","https://research.securitum.com/xss-in-amp4email-dom-clobbering","https://scnps.co/papers/sp23_domclob.pdf"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-64vr-g452-qvp3","url":"https://osv.dev/vulnerability/GHSA-64vr-g452-qvp3"}],"summary":"Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS"}