CVE-2026-118662
Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.
- Score
- CVSS 4.0 6.9 Medium
- Status
- Received - security-advisories@github.com
- Published
- 2026-10-28
- Last modified
- 2026-10-28
- Weaknesses
- CWE-180, CWE-284
Affected products
References
- https://github.com/vitejs/vite/security/advisories/GHSA-8g5g-mxqh-grgj
- https://github.com/vitejs/vite/pull/22160
- https://github.com/vitejs/vite/pull/23855
- https://github.com/vitejs/vite/commit/91e40d7bf9777057bbd31c3eb036a54c9465697e
- https://github.com/vitejs/vite/releases/tag/v6.4.5
