Risk: Websites were able to send any requests to the development server and read the response in vite #35
Description
https://github.com/radah19/vibes-app/security/dependabot/2
Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections.
Users that does not match either of the following conditions should be able to upgrade to a newer version of Vite that fixes the vulnerability without any additional configuration.
There's a suggested AI fix I won't take too much to heart, but it seems the version of Vite this project is using was flagged at risk of being less secure with handling CORS.