Security research · CVE-2026-112946
Vite is a frontend tooling framework for JavaScript.
Published Oct 20, 2026 · catalog updated Oct 21, 2026 · Vite is a frontend
Last checked Nov 3, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-112946. EPSS is 0.85%. Act only if a listed version of Vite is a frontend is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Vite is a frontend).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Medium6.3
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.85%
- Remediation
- Version ranges on file
- Affected products
- npm vite · npm vite-plus
### Summary The content of files outside setting can be returned to the browser if the project imports a file path concatenated with the . For example, if the project references , the content of was possible to be returned. The content of files outside the option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing could make Vite return the host's file. ### Impact Only apps that meet all of the following conditions are affected: - explicitly expose the Vite dev server to the network (using or the [ option](https://vite.dev/config/server-options#server-host)) - contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host - The sensitive file is not matched by [ ](https://vite.dev/config/server-options#server-fs-deny) - the dev server is not running on Windows ### Details When Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as . In affected versions, Vite converts that URL with and adds the result to . Because ensures a leading slash without resolving the URL against the project root, the project URL is recorded as if it were the absolute filesystem path . For a later request to , the raw-filesystem middleware interprets as an absolute path. The access check applies , then accepts paths present in before checking . As a result, the request can return the host file instead of the project file that originally populated . ### PoC The following example requires Linux with a readable : In another terminal:
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- npm vite0 → 6.4.4
- npm vite7.0.0 → 7.3.7
- npm vite8.0.0 → 8.1.6
- npm vite8.2.0 → 8.2.4
- npm vite8.3.0 → 8.3.3
- npm vite<= 6.4.3
- npm vite>= 7.0.0, <= 7.3.6
- npm vite>= 8.0.0, <= 8.1.5
- npm vite>= 8.2.0, <= 8.2.3
- npm vite>= 8.3.0, <= 8.3.2
- npm vite-plus0 → 1.1.0
- npm vite-plus<= 1.0.0
How to fix CVE-2026-112946
Upgrade
CVE-2026-112946 lists a fix boundary at 6.4.4. Compare the installed build with that boundary before you change production.
Version check
Affected <= 6.4.3
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-112946. EPSS is 0.85%. Act only if a listed version of Vite is a frontend is installed.
Which versions are affected?
Compare what you have installed with 0 → 6.4.4, 7.0.0 → 7.3.7, 8.0.0 → 8.1.6, 8.2.0 → 8.2.4, 8.3.0 → 8.3.3, <= 6.4.3. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-22: Path Traversal; CWE-284: Improper Access Control. EPSS 0.85%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Technology hubs
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 20, 2026 · NIST NVD
Detected
Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for tha
Oct 20, 2026 · NIST NVD
Updated
Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for tha
Oct 20, 2026 · NIST NVD
Updated
Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for tha
Oct 21, 2026 · GitHub Advisory Database
Fix available
vite fixed in 8.3.3; vite fixed in 8.2.4; vite fixed in 8.1.6; vite fixed in 7.3.7
Oct 21, 2026 · GitHub Advisory Database
Fix available
vite fixed in 8.3.3
Oct 21, 2026 · GitHub Advisory Database
Fix available
vite fixed in 8.2.4
Oct 21, 2026 · GitHub Advisory Database
Fix available
vite fixed in 8.1.6
Oct 21, 2026 · GitHub Advisory Database
Fix available
vite fixed in 7.3.7
Oct 21, 2026 · GitHub Advisory Database
Fix available
vite fixed in 6.4.4
Oct 21, 2026 · GitHub Advisory Database
Fix available
vite-plus fixed in 1.1.0
Oct 21, 2026 · GitHub Advisory Database
Updated
### Summary The content of files outside setting can be returned to the browser if the project imports a file path concatenated with the . For example, if the project references , the content of was possible to be returned. The content of files outside the option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example,
Sources
- CVE.orgVulnerability recordCVE-2026-112946
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-112946
30-day exploitation probability 0.85%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-rq7h-c2jc-7f22
Vite: Files outside could be served when project paths match system paths on non-Windows machine
github.com - NIST NVDVulnerability recordCVE-2026-112946
Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development serve
nvd.nist.gov - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-rq7h-c2jc-7f22
Vite: Files outside could be served when project paths match system paths on non-Windows machine
osv.dev
References
Freshness
Last verified in this catalog Nov 3, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 3, 2026
- GitHub Advisory DatabaseOct 22, 2026
- CVE.orgOct 21, 2026
- OpenSSF OSV / OSV ScannerOct 21, 2026
- NIST NVDOct 21, 2026