CVE-2026-118662

The record

Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.

Affected packages

Related vulnerabilities

• CVE-2026-93630 A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra… CWE-180
• CVE-2026-114622 baserCMS is a website development framework. CWE-180
• CVE-2026-110306 fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. CWE-180
• CVE-2026-100409 OpenNext Cloudflare is an open Next.js adapter for Cloudflare. CWE-180
• CVE-2026-102269 PyJWT is a Python implementation of JSON Web Token standards. CWE-180
• CVE-2026-82736 Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash… CWE-180
• CVE-2026-82481 The cohttp package before 6.3.0 for OCaml allows directory traversal. CWE-180
• CVE-2026-76203 Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer… CWE-180