CVE-2026-112946
Received Received - Intake

Path Traversal in Vite Development Server

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112946
EUVD
EUVD-2026-105128

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
vitejs vite >= 8.3.0, < 8.3.3
vitejs vite >= 8.2.0, < 8.2.4
vitejs vite >= 8.0.0, < 8.1.6
vitejs vite >= 7.0.0, < 7.3.7
vitejs vite < 6.4.4
vitejs vite-plus < 1.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-112946 is a path traversal vulnerability in Vite versions before 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3. It occurs because Vite incorrectly stored root-relative browser URLs in safeModulePaths instead of cleaned resolved module identifiers. This allowed an imported project file whose URL matched an absolute host path to authorize raw-filesystem requests for that host file, potentially exposing files outside the project root if server.fs.deny did not block them.

Detection Guidance

Check Vite version with 'npm list vite' or 'vite --version'. If using versions 6.4.3 and below, 7.0.0 to 7.3.6, 8.0.0 to 8.1.5, 8.2.0 to 8.2.3, or 8.3.0 to 8.3.2, the system is vulnerable. Inspect server configuration for 'server.fs.allow' and 'server.fs.deny' settings to verify if sensitive paths are exposed.

Impact Analysis

If you use an affected Vite version on a network-accessible, non-Windows development server, an attacker could trick Vite into serving sensitive system files like /etc/hosts or /etc/hostname by creating a matching project file path. This bypasses server.fs.allow restrictions and exposes files outside your project directory.

Mitigation Strategies

Upgrade Vite to versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, or 8.3.3 or later. Ensure 'server.fs.deny' blocks sensitive paths like '/etc/hosts'. Avoid exposing the dev server to the network unless necessary. Review 'server.fs.allow' to restrict access to only required directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112946. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart