Vulnerability Description
Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.
Related Weaknesses (CWE)
References
- https://github.com/vitejs/vite/commit/91e40d7bf9777057bbd31c3eb036a54c9465697e
- https://github.com/vitejs/vite/pull/22160
- https://github.com/vitejs/vite/pull/23855
- https://github.com/vitejs/vite/releases/tag/v6.4.5
- https://github.com/vitejs/vite/security/advisories/GHSA-8g5g-mxqh-grgj
FAQ
What is CVE-2026-118662?
CVE-2026-118662 is a documented vulnerability. Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw,...
How severe is CVE-2026-118662?
CVSS scoring is not yet available for CVE-2026-118662. Check NVD for updates.
Is there a patch for CVE-2026-118662?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.