CVE-2026-112946 · GHSA-rq7h-c2jc-7f22
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
- Risk score
- 54/100
- CVSS
- 6.3 v4.0
- Exploit chance (30 days)
- 0.9%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL m…
- Affected
- vite (npm) >= 8.3.0, <= 8.3.2; vite (npm) >= 8.2.0, <= 8.2.3; vite (npm) >= 8.0.0, <= 8.1.5; vite (npm) >= 7.0.0, <= 7.3.6
- Fix
- Upgrade vite to 8.3.3 or 8.2.4 or 8.1.6 or 7.3.7 or 6.4.4; vite-plus to 1.1.0 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
vite: Yellow, plan it in. Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL m…
The flaws
- CVE-2026-112946: Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine (CVSS 6.3 · EPSS 1%)
- CVE-2026-112947: Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` (CVSS 6.3 · EPSS 0%)
The fix
Upgrade vite: 6.4.4 · 7.3.7 · 8.1.6 · 8.2.4 · 8.3.3 or later on your release line
Who is exposed: vite (npm) >= 8.3.0, <= 8.3.2; vite (npm) >= 8.2.0, <= 8.2.3; vite (npm) >= 8.0.0, <= 8.1.5; vite (npm) >= 7.0.0, <= 7.3.6
Where it stands
- No known exploitation
Connects to
- Same weakness: Path traversal (CWE-22). 398 other warnings in 30 days
Why it is Yellow
- CVSS 6.3 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| vite | npm | >= 8.3.0, <= 8.3.2 | 8.3.3 |
| vite | npm | >= 8.2.0, <= 8.2.3 | 8.2.4 |
| vite | npm | >= 8.0.0, <= 8.1.5 | 8.1.6 |
| vite | npm | >= 7.0.0, <= 7.3.6 | 7.3.7 |
| vite | npm | <= 6.4.3 | 6.4.4 |
| vite-plus | npm | <= 1.0.0 | 1.1.0 |
References
- https://github.com/advisories/GHSA-rq7h-c2jc-7f22
- https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22
- https://nvd.nist.gov/vuln/detail/CVE-2026-112946
- https://github.com/vitejs/vite/pull/23656
- https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa
- https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721
- https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905
- https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0
- https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3
- https://github.com/advisories/GHSA-rq7h-c2jc-7f22
Original description
Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.
Last activity 20 Oct 2026. Patch Forecast updates every hour.