Live › vulnerability › CVE-2026-118662
Go to dashboardVite's development server checks server.fs.deny before removing loader query parameters such as ?raw, so an appended query can bypass the deny rule. An unauthenticated attacker who can reach an exposed dev server can read a sensitive file that sits inside server.fs.allow but matches server.fs.deny.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 21:35 UTC. All times on this page are UTC.
Teams running the Vite development server (vite dev or vite preview is not stated in the sources; unknown for preview) with a network-reachable host and a server.fs.deny rule that covers a file also inside server.fs.allow. Production builds served as static files are not described as affected. Teams that only run the dev server on localhost or behind authentication are at much lower risk.
No product ranges from the sources yet.
npx vite --version in the project and check whether it reports a version from 6.4.4 up to but not including 6.4.5.vite --host or server.host set to true or 0.0.0.0 in vite.config).server.fs.deny and server.fs.allow in vite.config for a sensitive file inside an allowed directory.vite to 6.4.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-118662")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.