CVE-2026-118662

Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.

CVSS

No CVSS.

References

Link	Resource
https://github.com/vitejs/vite/commit/91e40d7bf9777057bbd31c3eb036a54c9465697e
https://github.com/vitejs/vite/pull/22160
https://github.com/vitejs/vite/pull/23855
https://github.com/vitejs/vite/releases/tag/v6.4.5
https://github.com/vitejs/vite/security/advisories/GHSA-8g5g-mxqh-grgj

Configurations

No configuration.

History

28 Oct 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-28 21:16

Updated : 2026-10-29 16:19

NVD link : CVE-2026-118662

Mitre link : CVE-2026-118662

CVE.ORG link : CVE-2026-118662

JSON object : View

Products Affected

No product.

CWE

CWE-180

Incorrect Behavior Order: Validate Before Canonicalize

CWE-284

Improper Access Control

{"id": "CVE-2026-118662", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "vitejs", "product": "vite", "versions": [{"status": "affected", "version": ">= 6.4.4, < 6.4.5"}]}]}], "published": "2026-10-28T21:16:56.403", "references": [{"url": "https://github.com/vitejs/vite/commit/91e40d7bf9777057bbd31c3eb036a54c9465697e", "source": "security-advisories@github.com"}, {"url": "https://github.com/vitejs/vite/pull/22160", "source": "security-advisories@github.com"}, {"url": "https://github.com/vitejs/vite/pull/23855", "source": "security-advisories@github.com"}, {"url": "https://github.com/vitejs/vite/releases/tag/v6.4.5", "source": "security-advisories@github.com"}, {"url": "https://github.com/vitejs/vite/security/advisories/GHSA-8g5g-mxqh-grgj", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-180"}, {"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5."}], "lastModified": "2026-10-29T16:19:37.750", "sourceIdentifier": "security-advisories@github.com"}