Cloudanix VulnDB

CVE-2026-112945

None

CVSS

—

EPSS

0.7%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Vite development tool lets attackers trick browsers into running malicious code when certain custom server settings are used, which could let them steal information from the page.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Data Exposure
Component
Web Framework
Class
XSS
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Enables cross-site scripting in Vite development servers by allowing an attacker-supplied URL with leading slashes to be resolved via getHtmlFilename and server.transformIndexHtml, causing the browser to load and execute an attacker-controlled module script when inline modules are present in transformed HTML.

Why it matters to the business

Developers and users of affected applications risk exposure of sensitive page data or unauthorized actions during local development sessions, potentially leading to broader supply-chain risks if development artifacts influence production builds.

How an attack unfolds

An attacker identifies a Vite-based application using custom middleware that passes the raw browser request URL to transformIndexHtml, crafts a page containing an inline module script with a double-slash proxy URL, and tricks a victim into loading the development-server page so the browser fetches and executes attacker-controlled code.

How to fix it

Upgrade Vite to version 6.4.4, 7.3.7, 8.1.6, 8.2.4, or 8.3.3. Refactor custom middleware to sanitize or normalize request URLs before passing them to server.transformIndexHtml.

How to confirm the fix worked

Inspect package.json and lockfiles for Vite versions older than the fixed releases; attempt to reproduce the leading-slash module fetch against a test page containing inline scripts.

Typical attack path

  1. Locate a Vite application prior to the fixed versions that uses custom middleware passing unchanged request URLs to server.transformIndexHtml
  2. Craft a malicious development page containing an inline module script referencing a URL with leading double slashes
  3. Host or deliver the crafted page so a victim browser requests it through the vulnerable Vite dev server
  4. Browser resolves the leading-slash URL as an external module and executes attacker-controlled JavaScript
  5. Attacker exfiltrates sensitive data or triggers privileged actions within the application context

How to detect it

Review web server and Vite dev-server logs for requests containing double leading slashes followed by module paths; inspect browser network activity for unexpected external module fetches originating from inline scripts on development pages.

What your security team should do

  • Immediately upgrade all Vite instances to a patched version
  • Audit custom middleware for direct use of raw request URLs with transformIndexHtml
  • Disable or restrict development servers in untrusted environments until updated
  • Monitor EPSS trend and re-evaluate if exploit code appears

The record

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in the Vite-served page. This execution can expose sensitive page data or permit critical actions available to the affected application. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities