CVE-2026-112946: Vite Package Vulnerability Allows Exposure of Sensitive Files on Non-Windows Systems
Summary
CVE-2026-112946: The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root. Affects vite across 5 version ranges.
< 6.4.4
>= 7.0.0, < 7.3.7
>= 8.0.0, < 8.1.6
>= 8.2.0, < 8.2.4
>= 8.3.0, < 8.3.3
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vite is a modern build tool that provides a fast development environment for JavaScript applications. It is designed to enhance the development experience by offering features like hot module replacement and optimized builds. However, a vulnerability has been identified that allows unauthorized access to sensitive files on non-Windows machines when specific conditions are met.
Vulnerability Detail
The vulnerability arises from the way Vite handles file imports. If a project imports a file path that matches an absolute path on the host system, Vite may inadvertently serve files outside the intended directory. This occurs when the project is configured to expose the Vite dev server to the network and does not properly restrict access to sensitive files using the server.fs.deny option. As a result, files such as '/etc/hosts' can be accessed by an attacker, leading to potential data exposure.
How To Fix
Latest published version: 8.3.5 as of 22 Oct 2026
npm install vite@8.3.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.4.46.4.4npm install vite@6.4.4 -
>= 7.0.0, < 7.3.77.3.7npm install vite@7.3.7 -
>= 8.0.0, < 8.1.68.1.6npm install vite@8.1.6 -
>= 8.2.0, < 8.2.48.2.4npm install vite@8.2.4 -
>= 8.3.0, < 8.3.38.3.3npm install vite@8.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid exposing the Vite dev server to the network by not using the '--host' option or by setting the server.host option to 'localhost'. Additionally, ensure that sensitive files are included in the server.fs.deny configuration to prevent unauthorized access.
Conclusion
The CVE-2026-112946 vulnerability in the Vite package poses a risk of unauthorized access to sensitive files on non-Windows systems. Users are advised to update to the latest version or implement workarounds to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for vite →
FAQ
The CVSS score of this vulnerability is 6.3, indicating a moderate level of risk.
Affected versions include Vite versions 8.3.0 to 8.3.2, 8.2.0 to 8.2.3, 8.1.0 to 8.1.5, 7.0.0 to 7.3.6, and 6.0.0 to 6.4.3.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your package-lock.json file, you can check for vulnerabilities without needing to access the code.
Yes, you can mitigate the risk by configuring the server.fs.deny option to restrict access to sensitive files and by not exposing the Vite dev server to the network.
If immediate updates are not possible, implement the recommended workarounds to limit exposure and monitor for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for vite.
