CVE-2023-49293

Summary

CVE-2023-49293 is a vulnerability affecting Vite, a website frontend framework. When the HTML transformation feature is manually invoked with `server.transformIndexHtml`, malicious URL query strings can be used to inject arbitrary HTML into the transformed output. This only affects apps using `appType: 'custom'` and the default Vite HTML middleware, and requires users to click on a malicious URL while the dev server is running. Restricted files are not exposed to attackers. The vulnerability has been resolved in vite versions 5.0.5, 4.5.1, and 4.4.12. There are currently no known workarounds for this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.