CVE-2022-35204: 
JavaScript vulnerability analysis and mitigation

A directory traversal vulnerability was discovered in Vitejs Vite versions before v2.9.13, identified as CVE-2022-35204. The vulnerability was reported on June 8, 2022, and allows attackers to perform directory traversal attacks via crafted URLs to the victim's service (CVE Mitre).

The vulnerability stems from an incomplete fix of a previous issue (#2820), where the @fs directory checking mechanism failed to properly validate encoded paths. While the system checks for allowed paths, it can be bypassed using URL-encoded traversal sequences. For example, if /@fs/home/test/ is an allowed path, attackers could bypass restrictions using encoded sequences like /@fs/home/test/%2e%2e%2f%2e%2e%2f (which translates to ../../) (GitHub Issue).

This vulnerability allows attackers to access files outside of the intended directory structure, potentially exposing sensitive system files. The issue affects both Windows and Linux systems, enabling unauthorized access to system files such as /etc/hosts on Linux or C:/Windows/System32/drivers/etc/hosts on Windows systems (GitHub Issue).

The vulnerability was patched in Vite version 2.9.13. Users are strongly advised to upgrade to this version or later to protect against this security issue (GitHub Release).