{"id":"CVE-2026-112946","aliases":["CLSA-2026-1793091335","CLSA-2026-1793098696","CLSA-2026-1793099369","CLSA-2026-1793099859","CLSA-2026-1793099874","CLSA-2026-1793099905","CLSA-2026-1793099942","CLSA-2026-1793099987","CLSA-2026-1793100006","CLSA-2026-1793100032","CLSA-2026-1793100051","CLSA-2026-1793100627","CLSA-2026-1793100737","CLSA-2026-1793115223","CLSA-2026-1794302926","CLSA-2026-1794406408","CLSA-2026-1794412224","CLSA-2026-1794500099","EUVD-2026-105128","GHSA-rq7h-c2jc-7f22","UBUNTU-CVE-2026-112946"],"status":"published","title":"Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine","description":"Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00852,"percentile":0.58741,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-284"],"published":"2026-10-20T15:03:55Z","modified":"2026-11-12T19:30:04Z","fixes":[{"ecosystem":"npm","package":"vite","fixed_in":["8.3.3","8.2.4","8.1.6","7.3.7","6.4.4"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"vite-plus","fixed_in":["1.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"vite","fixed_in":["4.5.0-tuxcare.6","4.5.5-tuxcare.12"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.3.0"},{"last_affected":"8.3.2"},{"fixed":"8.3.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.0"},{"last_affected":"8.2.3"},{"fixed":"8.2.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"last_affected":"8.1.5"},{"fixed":"8.1.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.3.6"},{"fixed":"7.3.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.4.3"},{"fixed":"6.4.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite-plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.0"},{"fixed":"1.1.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.2-tuxcare.0"},{"fixed":"6.4.2-tuxcare.6"}]}],"versions":["6.4.2","6.4.2-tuxcare.1","6.4.2-tuxcare.2","6.4.2-tuxcare.3","6.4.2-tuxcare.4","6.4.2-tuxcare.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.6"}]}],"versions":["4.5.0","4.5.0-tuxcare.1","4.5.0-tuxcare.2","4.5.0-tuxcare.3","4.5.0-tuxcare.4","4.5.0-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.10-tuxcare.0"},{"fixed":"5.4.10-tuxcare.5"}]}],"versions":["5.4.10","5.4.10-tuxcare.1","5.4.10-tuxcare.2","5.4.10-tuxcare.3","5.4.10-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.10-tuxcare.0"},{"fixed":"8.0.10-tuxcare.2"}]}],"versions":["8.0.10","8.0.10-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.12-tuxcare.0"},{"fixed":"8.0.12-tuxcare.2"}]}],"versions":["8.0.12","8.0.12-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.3-tuxcare.0"},{"fixed":"7.3.3-tuxcare.3"}]}],"versions":["7.3.3","7.3.3-tuxcare.1","7.3.3-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.14-tuxcare.0"},{"fixed":"4.5.14-tuxcare.6"}]}],"versions":["4.5.14","4.5.14-tuxcare.1","4.5.14-tuxcare.2","4.5.14-tuxcare.3","4.5.14-tuxcare.4","4.5.14-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.11-tuxcare.0"},{"fixed":"3.2.11-tuxcare.8"}]}],"versions":["3.2.11","3.2.11-tuxcare.1","3.2.11-tuxcare.2","3.2.11-tuxcare.3","3.2.11-tuxcare.4","3.2.11-tuxcare.5","3.2.11-tuxcare.6","3.2.11-tuxcare.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.12-tuxcare.0"},{"fixed":"5.0.12-tuxcare.8"}]}],"versions":["5.0.12","5.0.12-tuxcare.1","5.0.12-tuxcare.2","5.0.12-tuxcare.3","5.0.12-tuxcare.4","5.0.12-tuxcare.5","5.0.12-tuxcare.6","5.0.12-tuxcare.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.9-tuxcare.0"},{"fixed":"8.0.9-tuxcare.2"}]}],"versions":["8.0.9","8.0.9-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.2-tuxcare.0"},{"fixed":"7.3.2-tuxcare.2"}]}],"versions":["7.3.2","7.3.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.5"}]}],"versions":["2.9.18","2.9.18-tuxcare.1","2.9.18-tuxcare.2","2.9.18-tuxcare.3","2.9.18-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3-tuxcare.0"},{"fixed":"6.4.3-tuxcare.2"}]}],"versions":["6.4.3","6.4.3-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.5-tuxcare.0"},{"fixed":"4.1.5-tuxcare.4"}]}],"versions":["4.1.5","4.1.5-tuxcare.1","4.1.5-tuxcare.2","4.1.5-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.5-tuxcare.0"},{"fixed":"4.5.5-tuxcare.12"}]}],"versions":["4.5.5","4.5.5-tuxcare.1","4.5.5-tuxcare.10","4.5.5-tuxcare.11","4.5.5-tuxcare.2","4.5.5-tuxcare.3","4.5.5-tuxcare.4","4.5.5-tuxcare.5","4.5.5-tuxcare.6","4.5.5-tuxcare.7","4.5.5-tuxcare.8","4.5.5-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite-plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.7-tuxcare.0"},{"fixed":"0.2.7-tuxcare.1"}]}],"versions":["0.2.7"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite-plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.3-tuxcare.0"},{"fixed":"0.3.3-tuxcare.1"}]}],"versions":["0.3.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.16-tuxcare.0"},{"fixed":"8.0.16-tuxcare.2"}]}],"versions":["8.0.16","8.0.16-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"8.3.0"},{"fixed":"8.3.3"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"8.2.0"},{"fixed":"8.2.4"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.1.6"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.3.7"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.4.4"}]}]},{"source":"osv","ecosystem":"npm","package":"vite-plus","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2+svn1430-2","1.2+svn1430-3","1.2+svn1430-4","1.2+svn1430-5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2+svn1430-5","1.2+svn1430-6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2+svn1430-6","1.2+svn1430-6build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2+svn+git4.c6c0ce7-3","1.2+svn+git4.c6c0ce7-4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2+svn+git4.c6c0ce7-8","1.2+svn+git4.c6c0ce7-8build1","1.2+svn+git4.c6c0ce7-8build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-6","1.4-6build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-1","1.4-5","1.4-5build1","1.4-6"]}],"products":[{"vendor":"vitejs","product":"vite"},{"vendor":"vitejs","product":"vite-plus"},{"vendor":"voidzero-dev","product":"vite-plus"}],"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/vitejs/vite/pull/23656","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112946","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rq7h-c2jc-7f22"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112946.json","tags":["advisory"]},{"url":"https://github.com/vitejs/vite","tags":["package","report"]},{"url":"https://ubuntu.com/security/CVE-2026-112946","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-112946","tags":["report"]},{"url":"https://github.com/cveproject/cvelistv5/tree/main/cves/2026/112xxx/cve-2026-112946.json","tags":["report"]},{"url":"https://github.com/vitejs/vite/security/advisories/ghsa-rq7h-c2jc-7f22","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/cve-2026-112946","tags":["report"]},{"url":"https://advisory.echohq.com/cve/cve-2026-112946","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-112946","title":"Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine","description":"Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.","status":"published","published":"2026-10-20T15:03:55.196Z","modified":"2026-10-20T16:46:18.81Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22","CWE-284"],"updated_at":"2026-11-02T13:44:40.64332Z"}],"euvd":[{"id":"EUVD-2026-105128","description":"Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.","status":"published","published":"2026-10-20T15:03:55Z","modified":"2026-10-20T16:46:18Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:43.600473Z"}],"ghsa":[{"id":"GHSA-rq7h-c2jc-7f22","title":"Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine","description":"### Summary\n\nThe content of files outside `server.fs` setting can be returned to the browser if the project imports a file path concatenated with the `root`. For example, if the project references `\u003cpath-to-project-root\u003e/etc/hosts`, the content of `/etc/hosts` was possible to be returned.\n\nThe content of files outside the `server.fs.allow` option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing `\u003cproject-root\u003e/etc/hosts` could make Vite return the host's `/etc/hosts` file.\n\n### Impact\n\nOnly apps that meet all of the following conditions are affected:\n\n- explicitly expose the Vite dev server to the network (using `--host` or the [`server.host` option](https://vite.dev/config/server-options#server-host))\n- contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host\n- The sensitive file is not matched by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny)\n- the dev server is not running on Windows\n\n### Details\n\nWhen Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as `/etc/hostname`. In affected versions, Vite converts that URL with `fsPathFromUrl` and adds the result to `safeModulePaths`. Because `fsPathFromUrl` ensures a leading slash without resolving the URL against the project root, the project URL `/etc/hostname` is recorded as if it were the absolute filesystem path `/etc/hostname`.\n\nFor a later request to `/@fs/etc/hostname`, the raw-filesystem middleware interprets `/etc/hostname` as an absolute path. The access check applies `server.fs.deny`, then accepts paths present in `safeModulePaths` before checking `server.fs.allow`. As a result, the request can return the host file instead of the project file that originally populated `safeModulePaths`.\n\n### PoC\nThe following example requires Linux with a readable `/etc/hostname`:\n```bash\n$ mkdir vite-safe-module-path-poc\n$ cd vite-safe-module-path-poc\n$ npm init -y\n$ npm install vite@8.3.1\n$ mkdir -p etc\n$ echo 'PROJECT-DECOY\\n' \u003e etc/hostname\n$ echo 'import \"./etc/hostname\"\\n' \u003e main.js\n$ npx vite --host 127.0.0.1\n```\n\nIn another terminal:\n```bash\n$ curl -o /dev/null -s -w '%{http_code}\\n' http://127.0.0.1:5173/main.js\n200\n$ curl -sS -o response -w '%{http_code}\\n' http://127.0.0.1:5173/@fs/etc/hostname\n200\n$ cmp -s response /etc/hostname \u0026\u0026 echo 'response matches host file'\nresponse matches host file\n```","status":"published","published":"2026-10-21T16:47:42Z","modified":"2026-10-21T16:47:43Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22","CWE-284"],"updated_at":"2026-11-02T14:41:33.669646Z"}],"nvd":[{"id":"CVE-2026-112946","description":"Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.","status":"published","published":"2026-10-20T16:17:05.21Z","modified":"2026-10-20T19:56:45.543Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-22","CWE-284"],"updated_at":"2026-11-02T14:13:01.161484Z"}],"osv":[{"id":"CVE-2026-112946","title":"Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine","description":"Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.","status":"published","published":"2026-10-20T15:03:55.196Z","modified":"2026-11-11T10:47:23.234612913Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22","CWE-284"],"updated_at":"2026-11-11T03:22:04.464623Z"},{"id":"GHSA-rq7h-c2jc-7f22","title":"Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine","description":"### Summary\n\nThe content of files outside `server.fs` setting can be returned to the browser if the project imports a file path concatenated with the `root`. For example, if the project references `\u003cpath-to-project-root\u003e/etc/hosts`, the content of `/etc/hosts` was possible to be returned.\n\nThe content of files outside the `server.fs.allow` option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing `\u003cproject-root\u003e/etc/hosts` could make Vite return the host's `/etc/hosts` file.\n\n### Impact\n\nOnly apps that meet all of the following conditions are affected:\n\n- explicitly expose the Vite dev server to the network (using `--host` or the [`server.host` option](https://vite.dev/config/server-options#server-host))\n- contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host\n- The sensitive file is not matched by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny)\n- the dev server is not running on Windows\n\n### Details\n\nWhen Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as `/etc/hostname`. In affected versions, Vite converts that URL with `fsPathFromUrl` and adds the result to `safeModulePaths`. Because `fsPathFromUrl` ensures a leading slash without resolving the URL against the project root, the project URL `/etc/hostname` is recorded as if it were the absolute filesystem path `/etc/hostname`.\n\nFor a later request to `/@fs/etc/hostname`, the raw-filesystem middleware interprets `/etc/hostname` as an absolute path. The access check applies `server.fs.deny`, then accepts paths present in `safeModulePaths` before checking `server.fs.allow`. As a result, the request can return the host file instead of the project file that originally populated `safeModulePaths`.\n\n### PoC\nThe following example requires Linux with a readable `/etc/hostname`:\n```bash\n$ mkdir vite-safe-module-path-poc\n$ cd vite-safe-module-path-poc\n$ npm init -y\n$ npm install vite@8.3.1\n$ mkdir -p etc\n$ echo 'PROJECT-DECOY\\n' \u003e etc/hostname\n$ echo 'import \"./etc/hostname\"\\n' \u003e main.js\n$ npx vite --host 127.0.0.1\n```\n\nIn another terminal:\n```bash\n$ curl -o /dev/null -s -w '%{http_code}\\n' http://127.0.0.1:5173/main.js\n200\n$ curl -sS -o response -w '%{http_code}\\n' http://127.0.0.1:5173/@fs/etc/hostname\n200\n$ cmp -s response /etc/hostname \u0026\u0026 echo 'response matches host file'\nresponse matches host file\n```","status":"published","published":"2026-10-21T16:47:42Z","modified":"2026-10-21T17:00:06.336868869Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22","CWE-284"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"UBUNTU-CVE-2026-112946","description":"Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.","status":"published","published":"2026-10-20T16:17:00Z","modified":"2026-10-28T17:50:36Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:59.591851Z"},{"id":"CLSA-2026-1793091335","title":"TuxCare security update for vite (3 CVEs)","description":"TuxCare rebuilt vite to address 3 CVEs. Fixed in 6.4.2-tuxcare.6.","status":"published","published":"2026-10-27T08:55:35Z","modified":"2026-10-27T13:30:04.656457573Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793098696","title":"TuxCare security update for vite (1 CVE)","description":"TuxCare rebuilt vite to address 1 CVE. Fixed in 4.5.0-tuxcare.6.","status":"published","published":"2026-10-27T10:58:16Z","modified":"2026-10-27T13:30:09.269230312Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793099369","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 5.4.10-tuxcare.5.","status":"published","published":"2026-10-27T11:09:29Z","modified":"2026-10-27T13:30:07.371155526Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793099859","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 8.0.10-tuxcare.2.","status":"published","published":"2026-10-27T11:17:39Z","modified":"2026-10-27T13:30:16.634790026Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793099874","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 8.0.12-tuxcare.2.","status":"published","published":"2026-10-27T11:17:54Z","modified":"2026-10-27T13:30:13.034401255Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793099905","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 7.3.3-tuxcare.3.","status":"published","published":"2026-10-27T11:18:25Z","modified":"2026-10-27T13:30:09.765261022Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793099942","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 4.5.14-tuxcare.6.","status":"published","published":"2026-10-27T11:19:02Z","modified":"2026-10-29T19:45:50.307466903Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793099987","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 3.2.11-tuxcare.8.","status":"published","published":"2026-10-27T11:19:47Z","modified":"2026-10-29T19:45:50.416176732Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793100006","title":"TuxCare security update for vite (4 CVEs)","description":"TuxCare rebuilt vite to address 4 CVEs. Fixed in 5.0.12-tuxcare.8.","status":"published","published":"2026-10-27T11:20:06Z","modified":"2026-11-07T01:00:02.463555823Z","updated_at":"2026-11-07T01:26:17.791146Z"},{"id":"CLSA-2026-1793100032","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 8.0.9-tuxcare.2.","status":"published","published":"2026-10-27T11:20:32Z","modified":"2026-10-27T13:30:13.984579411Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793100051","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 7.3.2-tuxcare.2.","status":"published","published":"2026-10-27T11:20:51Z","modified":"2026-10-27T13:30:08.307229925Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793100627","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 2.9.18-tuxcare.5.","status":"published","published":"2026-10-27T11:30:27Z","modified":"2026-10-29T19:45:50.388295679Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793100737","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 6.4.3-tuxcare.2.","status":"published","published":"2026-10-27T11:32:17Z","modified":"2026-10-27T13:30:08.353075899Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793115223","title":"TuxCare security update for vite (4 CVEs)","description":"TuxCare rebuilt vite to address 4 CVEs. Fixed in 4.1.5-tuxcare.4.","status":"published","published":"2026-10-27T15:33:43Z","modified":"2026-10-27T19:30:06.784084796Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1794302926","title":"TuxCare security update for vite (1 CVE)","description":"TuxCare rebuilt vite to address 1 CVE. Fixed in 4.5.5-tuxcare.12.","status":"published","published":"2026-11-10T10:28:47Z","modified":"2026-11-10T13:15:06.34857439Z","updated_at":"2026-11-10T13:29:51.103746Z"},{"id":"CLSA-2026-1794406408","title":"TuxCare security update for vite-plus (5 CVEs)","description":"TuxCare rebuilt vite-plus to address 5 CVEs. Fixed in 0.2.7-tuxcare.1.","status":"published","published":"2026-11-11T15:13:29Z","modified":"2026-11-11T19:30:05.193587426Z","updated_at":"2026-11-11T19:50:24.684142Z"},{"id":"CLSA-2026-1794412224","title":"TuxCare security update for vite-plus (6 CVEs)","description":"TuxCare rebuilt vite-plus to address 6 CVEs. Fixed in 0.3.3-tuxcare.1.","status":"published","published":"2026-11-11T16:50:25Z","modified":"2026-11-11T19:30:04.783286761Z","updated_at":"2026-11-11T19:50:24.684142Z"},{"id":"CLSA-2026-1794500099","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 8.0.16-tuxcare.2.","status":"published","published":"2026-11-12T17:15:00Z","modified":"2026-11-12T19:30:04.286499891Z","updated_at":"2026-11-12T19:43:48.38408Z"}]}}