{"action":"Upgrade vite to 2.9.18 or later.","affected":[{"fixed":"2.9.18","introduced":"2.7.0"},{"fixed":"3.2.10","introduced":"3.0.0"},{"fixed":"4.5.3","introduced":"4.0.0"},{"fixed":"5.0.13","introduced":"5.0.0"},{"fixed":"5.1.7","introduced":"5.1.0"},{"fixed":"5.2.6","introduced":"5.2.0"}],"component":"vite","cve_ids":["CVE-2024-31207"],"ecosystem":"npm","epss":0.00711,"exploited":false,"fixed_versions":["2.9.18","3.2.10","4.5.3","5.0.13","5.1.7","5.2.6"],"ghsa_id":"GHSA-8jhw-289h-jh2g","id":"tcs_01M5KFD9PWJGQS9RY765ZBGDPX","modified_at":"2026-09-10T03:50:12.501660467Z","published_at":"2024-04-03T16:46:17Z","references":["https://osv.dev/vulnerability/GHSA-8jhw-289h-jh2g","https://github.com/vitejs/vite/security/advisories/GHSA-8jhw-289h-jh2g","https://nvd.nist.gov/vuln/detail/CVE-2024-31207","https://github.com/vitejs/vite/commit/011bbca350e447d1b499d242804ce62738c12bc0","https://github.com/vitejs/vite/commit/5a056dd2fc80dbafed033062fe6aaf4717309f48","https://github.com/vitejs/vite/commit/89c7c645f09d16a38f146ef4a1528f218e844d67","https://github.com/vitejs/vite/commit/96a7f3a41ef2f9351c46f3ab12489bb4efa03cc9","https://github.com/vitejs/vite/commit/ba5269cca81de3f5fbb0f49d58a1c55688043258","https://github.com/vitejs/vite/commit/d2db33f7d4b96750b35370c70dd2c35ec3b9b649","https://github.com/vitejs/vite"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-8jhw-289h-jh2g","url":"https://osv.dev/vulnerability/GHSA-8jhw-289h-jh2g"}],"summary":"Vite's `server.fs.deny` did not deny requests for patterns with directories."}