Open Redirect Affecting litestar-vite package, versions [,0.15.0a7)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-LITESTARVITE-14860934
- published5 Jan 2026
- disclosed1 Jan 2026
- creditUnknown
Introduced: 1 Jan 2026
CVE NOT AVAILABLE CWE-601 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade litestar-vite to version 0.15.0a7 or higher.
Overview
litestar-vite is a Vite plugin for Litestar
Affected versions of this package are vulnerable to Open Redirect due to missing same-origin validation on redirect targets. The InertiaBack redirect logic trusts the Referer header, and InertiaRedirect accepts a redirect_to parameter without validating that the resulting URL is same-origin or relative. Additionally, the redirect response classes in the Inertia integration pass cookies=request.cookies, causing client cookies to be reflected via response cookie handling.