Vite

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

Vite has an `server.fs.deny` bypass with an invalid `request-target`

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS

launch-editor: escapeCmdArgs() omits % escaping on Windows

Vite's server.fs.deny bypassed with /. for files under project root

Vite's `server.fs.deny` did not deny requests for patterns with directories.

Vite XSS vulnerability in `server.transformIndexHtml` via URL payload