CVE-2026-53571

What it actually does

A path normalization vulnerability in the Vite development server on Windows allows an unauthenticated, remote attacker to bypass the `server.fs.deny` access control mechanism. By crafting requests using NTFS Alternate Data Stream (ADS) syntax (e.g., `file::$DATA`) or legacy 8.3 short names, an attacker can read the contents of sensitive files that are intended to be protected, such as `.env` files or TLS certificates. This results in an information disclosure vulnerability.

Why it matters to the business

Exploitation of this vulnerability can lead to the theft of sensitive credentials, API keys, and private certificates from development environments. These stolen secrets can be used to pivot to other systems, access production data, and cause significant data breaches. The compromise of development secrets undermines the security of the entire software supply chain and can lead to reputational damage and financial loss.

How an attack unfolds

An attacker identifies a publicly accessible Vite development server running on a Windows host. The attacker crafts a malicious HTTP GET request targeting a sensitive file, such as `.env`. Instead of requesting the file directly, which would be blocked, the attacker appends NTFS Alternate Data Stream syntax to the path, for example, `http://<target>/.env::$DATA`. The vulnerable Vite server fails to properly sanitize this path before checking it against its deny list. The underlying Windows OS, however, interprets the request as a valid path to the file's content, causing Vite to serve the sensitive file to the attacker, thereby bypassing the intended security control.

How to fix it

To remediate this vulnerability, upgrade the Vite package to a fixed version: 8.0.16, 7.3.5, 6.4.3, or later. Use your project's package manager (e.g., `npm update vite` or `yarn upgrade vite`) to apply the update. As a defense-in-depth measure, ensure that development servers are not exposed to the public internet. Restrict access to trusted networks or require a VPN connection.

How to confirm the fix worked

To validate the fix, inspect your project's lock file (`package-lock.json`, `yarn.lock`) or run `npm list vite` to confirm that the installed version is 8.0.16+, 7.3.5+, or 6.4.3+. To test for the vulnerability, start the Vite development server and attempt to access a protected file using a crafted path from a remote machine (e.g., `curl http://<server-ip>:<port>/.env::$DATA`). A patched server should return a 403 Forbidden or similar error, while a vulnerable server will return the file's contents.

Typical attack path

1. An attacker discovers a Vite development server running on a Windows machine exposed to the internet.
2. The attacker crafts an HTTP request for a sensitive file (e.g., `.env`, `.pem`) using a bypass technique like NTFS ADS syntax (`/.env::$DATA`).
3. The vulnerable Vite server receives the request and fails to apply its `server.fs.deny` rule due to the improper path normalization.
4. The server returns the contents of the sensitive file in the HTTP response.
5. The attacker exfiltrates the file's contents, gaining access to secrets like API keys, database credentials, or private keys.

How to detect it

To detect potential exploitation, review access logs for the Vite development server. Search for HTTP GET requests where the requested URI path contains the string `::$DATA`. Successful exploitation attempts will likely have a `200 OK` status code for these malformed requests. Also, look for suspicious requests using 8.3 short names (e.g., `CONFIG~1.JS`), which may also indicate an attempt to bypass file access controls.

• ::$DATA

What your security team should do

• Prioritize upgrading all Vite instances on Windows development environments to a patched version (8.0.16, 7.3.5, or 6.4.3).
• Immediately audit and restrict network access to all development servers, ensuring they are not publicly accessible.
• Assume any secrets within projects using vulnerable Vite versions have been compromised and initiate a rotation of all credentials, API keys, and certificates.