VULN UPGRADE: vite (minor → 3.2.11) [CTFd/themes]

[campaigner-prod]

Summary: High-severity security update — 1 package upgraded (MINOR changes included)

Manifests changed:

• CTFd/themes (npm)

Updates

Package	From	To	Type	Vulnerabilities Fixed
vite	3.0.5	3.2.11	minor	2 HIGH, 10 MODERATE, 2 LOW

---

Security Details

🚨 Critical & High Severity (2 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
vite	GHSA-353f-5xf4-qw67	HIGH	Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)	3.0.5	2.9.16
vite	GHSA-c24v-8rfc-w8vw	HIGH	Vite dev server option server.fs.deny can be bypassed when hosted on case-insensitive filesystem	3.0.5	2.9.17

ℹ️ Other Vulnerabilities (12)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
vite	GHSA-vg6x-rcgg-rjx6	MODERATE	Websites were able to send any requests to the development server and read the response in vite	3.0.5	6.0.9
vite	GHSA-859w-5945-r5v3	MODERATE	Vite's server.fs.deny bypassed with /. for files under project root	3.0.5	6.3.4
vite	GHSA-356w-63v5-8wf4	MODERATE	Vite has an server.fs.deny bypass with an invalid request-target	3.0.5	6.2.6
vite	GHSA-x574-m823-4x7w	MODERATE	Vite bypasses server.fs.deny when using ?raw??	3.0.5	6.2.3
vite	GHSA-93m4-6634-74q7	MODERATE	vite allows server.fs.deny bypass via backslash on Windows	3.0.5	7.1.11
vite	GHSA-9cwx-2883-4wfx	MODERATE	Vite's server.fs.deny is bypassed when using ?import&raw	3.0.5	5.4.6
vite	GHSA-xcj6-pq6g-qj4x	MODERATE	Vite allows server.fs.deny to be bypassed with .svg or relative paths	3.0.5	6.2.5
vite	GHSA-8jhw-289h-jh2g	MODERATE	Vite's server.fs.deny did not deny requests for patterns with directories.	3.0.5	2.9.18
vite	GHSA-64vr-g452-qvp3	MODERATE	Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS	3.0.5	5.4.6
vite	GHSA-4r4m-qw57-chr8	MODERATE	Vite has a server.fs.deny bypassed for inline and raw with ?import query	3.0.5	6.2.4
vite	GHSA-jqfw-vq24-v9c3	LOW	Vite's server.fs settings were not applied to HTML files	3.0.5	7.1.5
vite	GHSA-g4jq-h2w9-997c	LOW	Vite middleware may serve files starting with the same name with the public directory	3.0.5	7.1.5

---

Review Checklist

Enhanced review recommended for this update:

• Review changes for compatibility with your code
• Check release notes for breaking changes
• Run integration tests to verify service behavior
• Test in staging environment before production
• Monitor key metrics after deployment

---

Update Mode: Vulnerability Remediation (High)

🤖 Generated by DataDog Automated Dependency Management System