DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Partial Red Hat: 1 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to `cjs`/`iife`/`umd` output format. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present. DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. We have identified a DOM Clobbering vulnerability in Vite bundled scripts, particularly when the scripts dynamically import other scripts from the assets folder and the developer sets the build output format to `cjs`, `iife`, or `umd`. In such cases, Vite replaces relative paths starting with `__VITE_ASSET__` using the URL retrieved from `document.currentScript`. However, this implementation is vulnerable to a DOM Clobbering attack. The `document.currentScript` lookup can be shadowed by an attacker via the browser's named DOM tree element access mechanism. This manipulation allows an attacker to replace the intended script element with a malicious HTML element. When this happens, the src attribute of the attacker-controlled element is used as the URL for importing scripts, potentially leading to the dynamic loading of scripts from an attacker-controlled server. This vulnerability can result in cross-site scripting (XSS) attacks on websites that include Vite-bundled files (configured with an output format of `cjs`, `iife`, or `umd`) and allow users to inject certain scriptless HTML tags without properly sanitizing the name or id attributes. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vitejs | vite | 5.4.0 to before 5.4.6; 5.3.0 to before 5.3.6; 5.0.0 to before 5.2.14; 4.0.0 to before 4.5.5; before 3.2.11 | 5.4.6, 5.3.6, 5.2.14, 4.5.5, 3.2.11 | Patch available | CNA |
| — | vite (npm) | 5.4.0 to before 5.4.6 | 5.4.6 | Patch available | GHSA-64vr-g452-qvp3 |
| — | vite (npm) | 5.3.0 to before 5.3.6 | 5.3.6 | Patch available | GHSA-64vr-g452-qvp3 |
| — | vite (npm) | 5.2.0 to before 5.2.14 | 5.2.14 | Patch available | GHSA-64vr-g452-qvp3 |
| — | vite (npm) | 4.0.0 to before 4.5.4 | 4.5.4 | Patch available | GHSA-64vr-g452-qvp3 |
| — | vite (npm) | before 3.2.11 | 3.2.11 | Patch available | GHSA-64vr-g452-qvp3 |
| — | vite (npm) | 5.0.0 to before 5.1.8 | 5.1.8 | Patch available | GHSA-64vr-g452-qvp3 |
- vite Vendorvitejs Affected 5.4.0 to before 5.4.6; 5.3.0 to before 5.3.6; 5.0.0 to before 5.2.14; 4.0.0 to before 4.5.5; before 3.2.11 Fixed in 5.4.6, 5.3.6, 5.2.14, 4.5.5, 3.2.11 Patch available CNA
- vite (npm) Vendor— Affected 5.4.0 to before 5.4.6 Fixed in 5.4.6 Patch available GHSA-64vr-g452-qvp3
- vite (npm) Vendor— Affected 5.3.0 to before 5.3.6 Fixed in 5.3.6 Patch available GHSA-64vr-g452-qvp3
- vite (npm) Vendor— Affected 5.2.0 to before 5.2.14 Fixed in 5.2.14 Patch available GHSA-64vr-g452-qvp3
- vite (npm) Vendor— Affected 4.0.0 to before 4.5.4 Fixed in 4.5.4 Patch available GHSA-64vr-g452-qvp3
- vite (npm) Vendor— Affected before 3.2.11 Fixed in 3.2.11 Patch available GHSA-64vr-g452-qvp3
- vite (npm) Vendor— Affected 5.0.0 to before 5.1.8 Fixed in 5.1.8 Patch available GHSA-64vr-g452-qvp3
Remediation
- Fix · CNA vite (vitejs) Fixed in 5.4.6, 5.3.6, 5.2.14, 4.5.5, 3.2.11
- Fix · GHSA-64vr-g452-qvp3 vite (npm) Fixed in 5.4.6 Advisory →
- Fix · GHSA-64vr-g452-qvp3 vite (npm) Fixed in 5.3.6 Advisory →
- Fix · GHSA-64vr-g452-qvp3 vite (npm) Fixed in 5.2.14 Advisory →
- Fix · GHSA-64vr-g452-qvp3 vite (npm) Fixed in 4.5.4 Advisory →
- Fix · GHSA-64vr-g452-qvp3 vite (npm) Fixed in 3.2.11 Advisory →
- Fix · GHSA-64vr-g452-qvp3 vite (npm) Fixed in 5.1.8 Advisory →
Red Hat 2 advisories
- RHSA-2024:10962 Released 2024-12-11 · Red Hat rating ImportantRed Hat OpenShift distributed tracing platform (Jaeger) 3.4 release
- Red Hat OpenShift distributed tracing 3.4 registry.redhat.io/rhosdt/jaeger-query-rhel8
- RHSA-2024:10917 Released 2024-12-10 · Red Hat rating ImportantRed Hat OpenShift distributed tracing platform (Jaeger) 3.4 release
- Red Hat OpenShift distributed tracing 3.4 registry.redhat.io/rhosdt/jaeger-query-rhel8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 3.4 | Fixed | RHSA-2024:10917, RHSA-2024:10962 |
Not affected: 4 products
- Red Hat Ansible Automation Platform 2
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat OpenShift distributed tracing 3
- Red Hat OpenShift distributed tracing 3.4
Timeline
- 2026-10-02 Threatist record created from CVE-2024-45812
- 2026-10-03 Alias added: GHSA-64vr-g452-qvp3
- 2026-10-25 EPSS moved to the 50th–90th percentile
References
Other 11
- https://github.com/vitejs/vite/security/advisories/GHSA-64vr-g452-qvp3
- https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986
- https://github.com/vitejs/vite/commit/ade1d89660e17eedfd35652165b0c26905259fad
- https://research.securitum.com/xss-in-amp4email-dom-clobbering
- https://scnps.co/papers/sp23_domclob.pdf
- https://github.com/vitejs/vite/commit/179b17773cf35c73ddb041f9e6c703fd9f3126af
- https://github.com/vitejs/vite/commit/2691bb3ff6b073b41fb9046909e1e03a74e36675
- https://github.com/vitejs/vite/commit/2ddd8541ec3b2d2e5b698749e0f2362ef28056bd
- https://github.com/vitejs/vite/commit/e8127166979e7ace6eeaa2c3b733c8994caa31f3
- https://github.com/vitejs/vite/commit/ebb94c5b3bf41950f45562595adec117a4d0ba5e
- https://github.com/vitejs/vite
More vitejs vulnerabilities
- TI-2025-22386 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query KEVCVSS 3.1HIGH 7.5
- TI-2025-41248 Code injection in vitejs vite-plugin-react CVSS 3.1CRITICAL 9.8
- TI-2026-28350 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket CVSS 4.0HIGH 8.2
- TI-2025-41735 @vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development CVSS 3.1HIGH 7.5
- TI-2025-21544 Vite bypasses server.fs.deny when using `?raw??` CVSS 3.1HIGH 7.5
- TI-2023-16938 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) CVSS 3.1HIGH 7.5
Sources
- CVE-2024-45812 · CVE Program
- CVE-2024-45812 · NVD
- FIRST EPSS
- GHSA-64vr-g452-qvp3 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-45812 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences