CVE-2023-49293
CVE-2023-49293 is a medium-severity vulnerability in Vitejs Vite with a CVSS 3.x base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-79.
Key facts
- Severity: Medium (CVSS 3.x base score 6.1)
- EPSS exploit prediction: 1% (58th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-79
- Affected product: Vitejs Vite
- Published:
- Last modified:
Description
Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original request URL is passed in unmodified, and the `html` being transformed contains inline module scripts (`<script type="module">...</script>`), it is possible to inject arbitrary HTML into the transformed output by supplying a malicious URL query string to `server.transformIndexHtml`. Only apps using `appType: 'custom'` and using the default Vite HTML middleware are affected. The HTML entry must also contain an inline script. The attack requires a user to click on a malicious URL while running the dev server. Restricted files aren't exposed to the attacker. This issue has been addressed in [email protected], [email protected], and [email protected]. There are no known workarounds for this vulnerability.
Frequently asked questions
- What is CVE-2023-49293?
- Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original request URL is passed in unmodified, and the `html` being transformed contains inline module scripts (`<script type="module">...</script>`), it is possible to inject arbitrary HTML into the transformed output by supplying a malicious URL query string to `server.transformIndexHtml`. Only apps using `appType: 'custom'` and using the default Vite HTML middleware are affected. The HTML entry must also contain an inline script. The attack requires a user to click on a malicious URL while running the dev server. Restricted files aren't exposed to the attacker. This issue has been addressed in [email protected], [email protected], and [email protected]. There are no known workarounds for this vulnerability.
- How severe is CVE-2023-49293?
- CVE-2023-49293 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
- Is CVE-2023-49293 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (58th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-49293?
- CVE-2023-49293 primarily affects Vitejs Vite. In total, 23 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2023-49293?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2023-49293 published?
- CVE-2023-49293 was published on 2023-12-04 and last updated on 2026-06-17.
References
Affected products (23)
- cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:-:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta0:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta1:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta10:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta11:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta12:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta13:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta14:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta15:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta16:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta17:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta18:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta19:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta2:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta20:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta3:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta4:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta5:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta6:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta7:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta8:*:*:*:node.js:*:*
- cpe:2.3:a:vitejs:vite:5.0.0:beta9:*:*:*:node.js:*:*
More vulnerabilities in Vitejs Vite
- CVE-2026-53571 — High (CVSS 7.5): Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are…
- CVE-2026-39364 — High (CVSS 7.5): Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server,…
- CVE-2026-39363 — High (CVSS 7.5): Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to…
- CVE-2024-23331 — High (CVSS 7.5): Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on…
- CVE-2023-34092 — High (CVSS 7.5): Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options…
- CVE-2025-24010 — Medium (CVSS 6.5): Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development…
All CVEs affecting Vitejs Vite →
Other CWE-79 (Cross-site Scripting (XSS)) vulnerabilities
- CVE-2025-49410 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC…
- CVE-2024-47875 — Critical (CVSS 10.0): DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to…
- CVE-2024-6886 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea…
- CVE-2023-45144 — Critical (CVSS 10.0): com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on…
- CVE-2023-45138 — Critical (CVSS 10.0): Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly.…
- CVE-2022-4361 — Critical (CVSS 10.0): Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the…
Browse all CWE-79 (Cross-site Scripting (XSS)) vulnerabilities →