CVE-2023-49293

Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original request URL is passed in unmodified, and the `html` being transformed contains inline module scripts (`<script type="module">...</script>`), it is possible to inject arbitrary HTML into the transformed output by supplying a malicious URL query string to `server.transformIndexHtml`. Only apps using `appType: 'custom'` and using the default Vite HTML middleware are affected. The HTML entry must also contain an inline script. The attack requires a user to click on a malicious URL while running the dev server. Restricted files aren't exposed to the attacker. This issue has been addressed in vite@5.0.5, vite@4.5.1, and vite@4.4.12. There are no known workarounds for this vulnerability.

• CWE-79

• https://github.com/vitejs/vite/security/advisories/GHSA-92r3-m2mg-pj97Exploit, Third Party Advisory
• https://github.com/vitejs/vite/security/advisories/GHSA-92r3-m2mg-pj97Exploit, Third Party Advisory

Published

Dec 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49288Squid is a caching proxy for the Web supporting HTTP, HTTPS,…7.5
• CVE-2023-49289Ajax.NET Professional (AjaxPro) is an AJAX framework for Mic…5.4
• CVE-2023-4929All firmware versions of the NPort 5000 Series are affected …8.8
• CVE-2023-49290lestrrat-go/jwx is a Go module implementing various JWx (JWA…5.3
• CVE-2023-49291tj-actions/branch-names is a Github action to retrieve branc…9.8
• CVE-2023-49292ecies is an Elliptic Curve Integrated Encryption Scheme for …4.8
• CVE-2023-49294Asterisk is an open source private branch exchange and telep…7.5
• CVE-2023-49295quic-go is an implementation of the QUIC protocol (RFC 9000,…6.5
• CVE-2023-49296The Arduino Create Agent allows users to use the Arduino Cre…6.1
• CVE-2023-49297PyDrive2 is a wrapper library of google-api-python-client th…7.8
• CVE-2023-49298OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain s…7.5
• CVE-2023-49299Improper Input Validation vulnerability in Apache DolphinSch…8.8