CVE-2023-49293 Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite
Attackers can inject arbitrary HTML via malicious URLs in Vite dev servers using custom app types, potentially executing code in the browser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-49293?
CVE-2023-49293 is a medium-severity cross-site scripting vulnerability in vitejs vite, published on 4 Dec 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original request URL is passed in unmodified, and the `html` being transformed contains inline module scripts (`<script type="module">...</script>`), it is possible to inject arbitrary HTML into the transformed output by supplying a malicious URL query string to `server.transformIndexHtml`. Only apps using `appType: 'custom'` and using the default Vite HTML middleware are affected. The HTML entry must also contain an inline script. The attack requires a user to click on a malicious URL while running the dev server. Restricted files aren't exposed to the attacker. This issue has been addressed in [email protected], [email protected], and [email protected]. There are no known workarounds for this vulnerability.
Weakness: CWE-79
Which versions are affected by CVE-2023-49293?
6 open source packages ship an affected version, including vite. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vite npm | From 4.4.0 | 4.4.12 |
vite npm | From 4.4.0 | 4.4.12 |
vite npm | From 4.5.0 | 4.5.1 |
vite npm | From 4.5.0 | 4.5.1 |
vite npm | From 5.0.0 | 5.0.5 |
vite npm | From 5.0.0 | 5.0.5 |
Products include Vitejs Vite.
How do I fix CVE-2023-49293?
Upgrade vite to a fixed version for your release line: 4.4.12, 4.5.1 or 5.0.5.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-49293 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-49293 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in vitejs vite
- CVE-2025-31125 Vite Vitejs Improper Access Control
- CVE-2026-53571 Vite: `server.fs.deny` bypass on Windows alternate paths
- CVE-2026-39363 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket
- CVE-2026-39364 Vite has a `server.fs.deny` bypass with queries
- CVE-2024-23331 Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Sources
Also known as GHSA-92r3-m2mg-pj97, MINI-8wm3-55cx-v9c3.