[bug]: Outdated Vite dependency using esbuild v0.21.5 (GHSA-67mh-4wv8-2f99)

[jendcruz22]

What's Wrong?

@strapi/pack-up@5.1.0 currently depends on vite@5.4.8, which is affected by multiple known vulnerabilities, including:

1. esbuild Vulnerability (GHSA-67mh-4wv8-2f99)

• vite@5.4.8 uses esbuild@0.21.5, which allows arbitrary websites to send requests to the dev server and read responses, due to overly permissive default CORS settings.
• This issue has been fixed in esbuild@0.25.0, which is used by vite@6.2.0 and above.

2. vite Vulnerability (GHSA-vg6x-rcgg-rjx6)

• vite@5.4.8 also has its own critical security issue, allowing Cross-Site WebSocket Hijacking (CSWSH) and code leakage via dev server responses over insecure WebSocket connections.
• This allows a malicious site to steal file paths, code snippets, or trigger plugin behaviors if the dev server is running.

Both vulnerabilities affect users even if the Vite dev server is only running locally (e.g., on localhost), which makes this a high-priority issue for development-time security.

Affected esbuild versions: <= 0.24.2
Affected vite versions: < 6.2.0
Patched in: >= 0.25.0
Patched vite version: >= 6.2.0

@strapi/pack-up@5.1.0
└─ vite@5.4.8
   └─ esbuild@0.21.5

To Reproduce

This vulnerability was identified during a security scan of our project:

Path: @strapi/pack-up@5.1.0 > vite@5.4.8 > esbuild@0.21.5

Expected Behaviour

Downstream users should not inherit vulnerable tooling dependencies, especially in commonly used dev-server environments. By upgrading vite, @strapi/pack-up will ensure:

• Development security hygiene
• Fewer audit issues for consumers
• Compatibility with the latest Vite plugin ecosystem

Recommendation

Please update vite in @strapi/pack-up to version ^6.2.0 or higher, which includes:

• A patched version of esbuild (>= 0.25.0)
• A fix for vite's own CORS/WebSocket/Host header vulnerabilities (GHSA-vg6x-rcgg-rjx6

Security References

• GHSA-67mh-4wv8-2f99 – esbuild CORS vulnerability
• GHSA-vg6x-rcgg-rjx6 – vite WebSocket & CORS dev server exposure

[jendcruz22]

Following up on this bug

[derrickmehaffy]

As of Strapi v5.15.0 we are using the latest version of vite (5.4.19):

dmehaffy@dm-desktop-lm:~/Development/testTID1780$ yarn why vite
yarn why v1.22.22
[1/4] Why do we have the module "vite"...?
[2/4] Initialising dependency graph...
[3/4] Finding dependency...
[4/4] Calculating file sizes...
=> Found "vite@5.4.19"
info Reasons this module exists
   - "@strapi#strapi" depends on it
   - Hoisted from "@strapi#strapi#vite"
info Disk size without dependencies: "3.24MB"
info Disk size with unique dependencies: "6.42MB"
info Disk size with transitive dependencies: "6.78MB"
info Number of shared dependencies: 7
Done in 0.57s.

The "vulnerability" in the nested esbuild of this doesn't impact production usage and only impacts the esbuild dev server with a weird default CORs config. The CORs options provided in Strapi should take precedence over this but regardless it doesn't impact production usage of Strapi and we do not support running Strapi in Dev mode in a deployed environment anyway.

At this time the vite team haven't released a version in the 5.x.x major with an updated ESBuild option and upgrading to Vite 6.x.x right now is not possible as it would cause several breaking changes. Once Vite releases an updated version we can upgrade to it but for now that's not possible nor does this vulnerability impact Strapi users.

Marking this issue as closed for now (PS we are phasing out packup entirely as it was only ever a wrapper around rollup).