CVE-2023-49293: Vite XSS vulnerability in server.transformIndexHtml via URL payload
Summary
CVE-2023-49293: Vite XSS vulnerability in server.transformIndexHtml via URL payload. Affects vite across 3 version ranges.
>= 4.4.0, < 4.4.12
>= 4.5.0, < 4.5.1
>= 5.0.0, < 5.0.5
Fixed in 4.4.12, 4.5.1 or 5.0.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vite is an open-source build tool for modern web applications. It provides fast and efficient development and production builds, hot module replacement, and a rich plugin system. Vite is widely used in the JavaScript ecosystem for building frontend applications. However, a vulnerability has been discovered in Vite that allows for cross-site scripting (XSS) attacks when using the server.transformIndexHtml function.
Vulnerability Detail
The vulnerability arises when Vite's HTML transformation is manually invoked via server.transformIndexHtml and the html being transformed contains inline module scripts. In this scenario, if a malicious URL query string is supplied to server.transformIndexHtml, it is possible to inject arbitrary HTML into the transformed output. This can lead to XSS attacks, where an attacker can execute malicious scripts in the context of the affected user's browser. The impact of this vulnerability is limited to apps using appType: 'custom' and the default Vite HTML middleware, with the HTML entry containing an inline script. The attack requires a user to click on a malicious URL while running the dev server.
How To Fix
Latest published version: 8.3.5 as of 22 Oct 2026
npm install vite@8.3.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.4.0, < 4.4.124.4.12npm install vite@4.4.12 -
>= 4.5.0, < 4.5.14.5.1npm install vite@4.5.1 -
>= 5.0.0, < 5.0.55.0.5npm install vite@5.0.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating Vite is not immediately feasible, a workaround for this vulnerability is to avoid using server.transformIndexHtml with untrusted user input. It is important to sanitize and validate any user-supplied data before passing it to this function to prevent the injection of malicious HTML.
Conclusion
The Vite XSS vulnerability in server.transformIndexHtml poses a risk to applications using Vite's HTML transformation functionality. It is crucial to update to the fixed versions of Vite or apply the recommended workaround to mitigate the risk of XSS attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vite →
FAQ
Vite versions 4.4.0-beta.2 and higher, including 4.4.0, are vulnerable to this XSS vulnerability.
The impact is limited to apps using appType: 'custom' and the default Vite HTML middleware, with the HTML entry containing an inline script. The attack requires a user to click on a malicious URL while running the dev server.
No, this vulnerability only affects development builds when using the Vite dev server.
There is no known public exploit for this vulnerability at the time of this report.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for vite.
