Cloudanix VulnDB

CVE-2026-112946

None

CVSS

—

EPSS

0.9%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in a popular web-development tool could let someone on the same network peek at certain files stored on the computer that is running the development server.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
Web Framework
Class
Path Traversal
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Import analysis in Vite records a root-relative browser URL into safeModulePaths instead of the resolved module identifier, allowing a later raw filesystem request to read a host-path file that matches an imported project file URL on non-Windows network-accessible dev servers, provided server.fs.deny does not block it.

Why it matters to the business

Development servers may leak source files or configuration outside the project root to an attacker on the same network, increasing risk of intellectual-property exposure or credential leakage during active development work.

How an attack unfolds

An attacker on the same network sends a crafted import request that causes the dev server to authorize a host-path URL; a subsequent raw-filesystem request for that same absolute path then returns the matching file content without further traversal checks.

How to fix it

Upgrade Vite to 6.4.4, 7.3.7, 8.1.6, 8.2.4 or 8.3.3 or later; ensure server.fs.deny rules cover expected host paths; restrict dev-server network exposure to trusted hosts only.

How to confirm the fix worked

Confirm the installed Vite version meets or exceeds one of the listed fixed releases; attempt a test import whose URL resolves to a host-path file outside the project root and verify the request is rejected.

Typical attack path

  1. Identify a network-reachable Vite dev server running an affected version
  2. Cause or observe an import whose browser URL matches an absolute host path
  3. Issue a raw filesystem request using that authorized host path
  4. Receive file contents located outside the project root

How to detect it

Search dev-server access logs for raw filesystem requests containing absolute host paths that do not originate from within the project root; monitor for successful responses returning content outside the intended directory.

What your security team should do

  • Prioritize upgrade of all internet-facing or multi-user dev servers within the next sprint
  • Add network segmentation or VPN requirements for any development servers
  • Review server.fs.deny configuration to explicitly deny common host-path patterns

The record

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities