{"id":"CVE-2026-118662","kind":"vulnerability","aliases":["CVE-2026-118662"],"related":[],"title":"Vite: dev server leaks denied files via loader query parameters","description":"Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.","summary":"Vite's development server checks server.fs.deny before removing loader query parameters such as ?raw, so an appended query can bypass the deny rule. An unauthenticated attacker who can reach an exposed dev server can read a sensitive file that sits inside server.fs.allow but matches server.fs.deny.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frontend","javascript","package","self-hosted","vite"],"not_affected_if":["auth-required","localhost-only-dev","production-static-build"],"how_to_check":"- Run `npx vite --version` in the project and check whether it reports a version from 6.4.4 up to but not including 6.4.5.\n- Check whether the dev server is reachable from the network (for example `vite --host` or `server.host` set to true or 0.0.0.0 in vite.config).\n- Check `server.fs.deny` and `server.fs.allow` in vite.config for a sensitive file inside an allowed directory.","fix":"- Upgrade `vite` to `6.4.5` or later.\n- Do not expose the Vite dev server to untrusted networks until upgraded.","status":"open","published_at":"2026-10-28T21:16:56+00:00","first_seen_at":"2026-10-28T21:35:45+00:00","triaged_at":"2026-10-28T21:36:36+00:00","updated_at":"2026-10-28T21:36:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T21:36:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `vite` to `6.4.5` or later.\n- Do not expose the Vite dev server to untrusted networks until upgraded.","reach":"network","title":"Vite: dev server leaks denied files via loader query parameters","impact":"medium","summary":"Vite's development server checks server.fs.deny before removing loader query parameters such as ?raw, so an appended query can bypass the deny rule. An unauthenticated attacker who can reach an exposed dev server can read a sensitive file that sits inside server.fs.allow but matches server.fs.deny.","category":"package","nicknames":[],"who_cares":["vite","frontend","self-hosted","javascript"],"confidence":0.7,"needs_auth":"no","worst_case":"unauthenticated attacker reads denied sensitive files from the dev server","analyst_note":"","how_to_check":"- Run `npx vite --version` in the project and check whether it reports a version from 6.4.4 up to but not including 6.4.5.\n- Check whether the dev server is reachable from the network (for example `vite --host` or `server.host` set to true or 0.0.0.0 in vite.config).\n- Check `server.fs.deny` and `server.fs.allow` in vite.config for a sensitive file inside an allowed directory.","needs_analyst":false,"not_affected_if":["localhost-only-dev","production-static-build","auth-required"],"who_is_affected":"Teams running the Vite development server (vite dev or vite preview is not stated in the sources; unknown for preview) with a network-reachable host and a server.fs.deny rule that covers a file also inside server.fs.allow. Production builds served as static files are not described as affected. Teams that only run the dev server on localhost or behind authentication are at much lower risk.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000656,"input_tokens":3370,"output_tokens":637,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118662':13A,16A '-2026':12A,15A '6.4.4':78C '6.4.5':80C,142C 'append':40B,126C 'attack':49B,124C 'bypass':43B 'check':28B 'cve':11A,14A 'deni':5A,45B,134C 'dev':2A,55B 'develop':26B,83C,104C 'evalu':86C 'expos':54B,107C 'file':6A,61B,114C,135C 'fix':139C 'framework':74C 'frontend':17B,72C 'host':22B 'import':96C,99C 'inlin':101C 'insid':64B,116C 'issu':137C 'javascript':18B,76C 'leak':4A 'loader':8A,32B,90C 'match':67B,119C 'network':110C 'one':127C 'packag':19B 'paramet':10A,34B,92C 'queri':9A,33B,41B,91C,130C 'raw':37B,95C,97C 'reach':52B 'read':58B 'remov':31B 'retriev':132C 'rule':46B 'self':21B 'self-host':20B 'sensit':60B,113C 'server':3A,27B,56B,84C,105C 'server.fs.allow':65B,117C 'server.fs.deny':29B,68B,87C,121C 'sit':63B 'strip':89C 'tool':73C 'unauthent':48B,123C 'url':100C 'version':141C 'via':7A 'vite':1A,23B,24B,69C,82C","nicknames":[],"mitigations":[],"who_affected":"Teams running the Vite development server (vite dev or vite preview is not stated in the sources; unknown for preview) with a network-reachable host and a server.fs.deny rule that covers a file also inside server.fs.allow. Production builds served as static files are not described as affected. Teams that only run the dev server on localhost or behind authentication are at much lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T21:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118662","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118662","severity":null,"published_at":"2026-10-28T21:16:56+00:00","modified_at":"2026-10-28T21:16:56+00:00","first_seen_at":"2026-10-28T21:35:45+00:00","fetched_at":"2026-10-28T21:35:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}