Repository navigation
fix(deps): upgrade vite to 5.4.21 to fix dev server arbitrary file read - #3291
Open
leizhiyuan wants to merge 1 commit into
Open
leizhiyuan wants to merge 1 commit into
leizhiyuan wants to merge 1 commit into
Conversation
|
|
The vite dev server serves files outside the project root through `?raw??`, `?import&raw??` and `?inline&raw??` queries when exposed to the network: CVE-2025-30208, CVE-2025-31125, CVE-2025-31486, plus the later fixes on the same code path (CVE-2025-32395, CVE-2025-46565, CVE-2025-58751, CVE-2025-58752, CVE-2025-62522). The patched 3.x line has no release, so anything below 4.5.12 is affected. - web-ui: vite 2.9.15 -> 5.4.21, @vitejs/plugin-vue 2.3.4 -> 5.2.4 and drop the removed `reactivityTransform` option. Bump the build node to v20.19.0 because vite 5 requires node >= 18. - site: vuepress 2.0.0-beta.51 pins vite ~3.0.9 and vuepress has no release that depends on a patched vite, so force 5.4.21 through yarn `resolutions`, and bump the build node to v20.19.0. Remove the stale site/package-lock.json: the Maven build uses yarn, and the npm lockfile can no longer be regenerated (peer conflicts) while still pinning the vulnerable vite 3.0.9. - labs/arthas-jfr-frontend: vite 5.4.19 -> 5.4.21, as 5.4.19 is still affected by CVE-2025-58751/58752 and CVE-2025-62522. The lockfile also gains the devDependencies it was missing (@vitejs/plugin-react). Verified with `mvn -pl web-ui,site -am generate-resources` (both frontends build on node v20.19.0) and by running both dev servers: requests such as `/@fs/etc/passwd?raw??` now return 403 instead of the file content, which is what vite 2.9.15 and 3.0.9 returned before the upgrade.
leizhiyuan
force-pushed
the
fix/vite-dev-server-cve
branch
from
November 9, 2026 07:51
b75d726 to
072ba99
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3290.
What
Every vite copy in the repository is moved to
5.4.21, which fixes the dev-serverserver.fs.denybypasses CVE-2025-30208, CVE-2025-31125, CVE-2025-31486 (fixed in4.5.12/5.4.17) as well as CVE-2025-32395, CVE-2025-46565, CVE-2025-58751, CVE-2025-58752 and CVE-2025-62522 (fixed in4.5.13/4.5.14/5.4.20/5.4.21). The 3.x line has no patched release, so3.0.9cannot stay.web-ui/arthasWebConsole@vitejs/plugin-vue2.3.4@vitejs/plugin-vue5.2.4site(via vuepress@vuepress/bundler-vite)resolutions)labs/arthas-jfr-frontendweb-ui/pom.xml,site/pom.xml)Changes worth a look:
web-ui/arthasWebConsole/vite.config.ts:vue({ reactivityTransform: ... })was a no-op with a bogus value and@vitejs/plugin-vue5 no longer has that option; the option is dropped and the project does not use ref sugar ($ref/$computed).site/package.json:vuepress 2.0.0-beta.51pinsvite ~3.0.9. No vuepress release depends on a patched vite (2.0.0-beta.67is still on~4.4.9), soresolutions: { "vite": "^5.4.21" }is used until vuepress is upgraded to2.0.0-rc.x. This is documented insite/README.md.site/package-lock.jsonis deleted: the Maven build installs with yarn (yarn.lock, reproducible viayarn install --frozen-lockfile), nothing in CI or the poms uses npm forsite, and the npm lockfile is stale (last regenerated 2022-09,lockfileVersion 2) and already broken —npm cifails onMissing: @esbuild/linux-loong64@0.15.5 from lock file. Keeping it only leaves a second source of truth that still pins vite 3.0.9 for dependency scanners. It can be restored from git history (git checkout 6d97217ed -- site/package-lock.json) if needed.site/pom.xml/web-ui/pom.xml: node v16 → v20.19.0, required because vite 5 needs node >= 18.labs/arthas-jfr-frontend/package-lock.json: besides the vite bump, npm re-synced the lockfile with the devDependencies it was missing (@vitejs/plugin-reactand its babel deps).Verification
mvn -pl web-ui,site -am generate-resources→ both frontends build (node v20.19.0, vite 5.4.21, 156 docs pages rendered).yarn install --frozen-lockfilepasses in both yarn projects./@fs/etc/passwd?raw??outside of Vite serving allow list/@fs/etc/passwd?import&raw??/@fs/etc/passwd?inline&raw??vuepress dev docsandvite --mode uiboth still serve the pages (HTTP 200) on 5.4.21.Follow-ups (not in this PR)
vuepress 2.0.0-rc.x(vite 8 / node >= 22.18) and drop theresolutionsoverride.web-uiloads its TS config through vite's CJS Node API, which is deprecated; renaming the config tovite.config.mtswould silence it, but that is unrelated to the CVE.