Executive Summary
Vite, a development server, is affected by a vulnerability (CVE-2026-112946) that allows sensitive files outside the server.fs setting to be returned to the browser. This flaw has a moderate severity and can be exploited by importing a file path concatenated with the `root` and exposing the dev server to the network.
Technical Impact & Vector
The vulnerability occurs when Vite rewrites the resolved module ID to a browser URL and then converts it using fsPathFromUrl. This allows the project URL to be recorded as if it were an absolute filesystem path. The raw-filesystem middleware then interprets the request as an absolute path, bypassing the server.fs.deny and server.fs.allow options, and returns the host file instead of the project file.
Remediation & Patch Instructions
To remediate this vulnerability, upgrade Vite to version 8.4.0 or later. For existing projects, run the following command to upgrade:
npx vite@8.4.0
For packages managed by npm, run:
npm install vite@8.4.0
For packages managed by yarn, run:
yarn add vite@8.4.0
For projects using pnpm, run:
pnpm install vite@8.4.0
No additional configuration is required; simply upgrading Vite to the patched version will resolve the issue.
Official Reference: Read the full vulnerability breakdown and advisory details directly on the National Vulnerability Database (CVE-2026-112946).
Leave a Reply