CVE-2026-112945: Vite Frontend Framework XSS Vulnerability

CVE-2026-112945 Overview

CVE-2026-112945 affects Vite, a frontend tooling framework for JavaScript. The vulnerability occurs when applications using custom middleware pass an unchanged browser request URL to server.transformIndexHtml. The getHtmlFilename function uses the query-bearing request URL to resolve a local file while preserving attacker-supplied leading slashes in the generated proxy module URL. When transformed HTML contains an inline module script, a victim browser loading the crafted development-server page fetches and executes an attacker-controlled module. The flaw is classified under [CWE-80] (improper neutralization of script-related HTML tags).

Critical Impact

Successful exploitation enables execution of attacker-controlled JavaScript in the Vite-served development page, exposing sensitive page data or permitting critical actions available to the application.

Affected Products

• Vite versions prior to 6.4.4
• Vite 7.x prior to 7.3.7, and 8.1.x prior to 8.1.6
• Vite 8.2.x prior to 8.2.4, and 8.3.x prior to 8.3.3

Discovery Timeline

• 2026-10-20 - CVE CVE-2026-112945 published to NVD
• 2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-112945

Vulnerability Analysis

The flaw resides in Vite's development server HTML transformation path. When custom middleware forwards an unmodified request URL into server.transformIndexHtml, the server uses that URL to locate the HTML file on disk and also to build proxy module URLs for inline <script type="module"> blocks. The URL retains attacker-controlled leading slashes, which the browser interprets as a protocol-relative URL. The inline module script is then rewritten to a path such as //attacker.example/payload.js, which the browser resolves to an external origin. The resulting fetch executes attacker-controlled JavaScript inside the Vite-served page's origin.

Root Cause

The getHtmlFilename function in packages/vite/src/node/server/middlewares/indexHtml.ts consumed the raw request URL without stripping the query string or normalizing leading slashes. The query component caused filesystem resolution to deviate from the sanitized path, while the preserved double-leading-slash propagated into the generated proxy module reference emitted in the transformed HTML.

Attack Vector

Exploitation requires a victim developer to load a crafted URL served by the Vite development server through middleware that forwards the request URL verbatim. The attacker supplies a path beginning with //attacker.tld/... plus a query that still resolves to an existing local HTML file containing an inline module script. The browser then loads the attacker-controlled module in the development origin's context.

// Patched function in packages/vite/src/node/server/middlewares/indexHtml.ts
function getHtmlFilename(url: string, server: ViteDevServer) {
  const urlPath = cleanUrl(url)
  if (urlPath.startsWith(FS_PREFIX)) {
    return decodeURIComponent(fsPathFromId(urlPath))
  } else {
    return decodeURIComponent(
      normalizePath(path.join(server.config.root, urlPath.slice(1))),
    )
  }
}
// Source: https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17

The fix routes the URL through cleanUrl to remove query strings before filesystem resolution, preventing the mismatch that let attacker-controlled path prefixes reach the emitted module reference.

Detection Methods for CVE-2026-112945

Indicators of Compromise

• Development server access logs containing request paths beginning with // or /\\ followed by an external hostname.
• Browser network requests from the Vite dev origin to unexpected third-party module URLs during local development.
• Transformed HTML responses from the dev server containing <script type="module" src="//..."> references not present in source files.

Detection Strategies

• Inspect middleware code for calls to server.transformIndexHtml(req.url, ...) where req.url is passed without sanitization.
• Audit installed Vite versions in package.json and lockfiles against the fixed versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.
• Review repository CI logs for development-server exposure beyond localhost, which increases exploitability.

Monitoring Recommendations

• Monitor outbound network connections from developer workstations running Vite dev servers for connections to unknown module hosts.
• Alert on dev-server HTTP request paths that contain backslashes, double slashes, or encoded slash variants in the URL leading segment.
• Track dependency updates and generate alerts when projects remain on vulnerable Vite releases.

How to Mitigate CVE-2026-112945

Immediate Actions Required

• Upgrade Vite to one of the fixed releases: 6.4.4, 7.3.7, 8.1.6, 8.2.4, or 8.3.3.
• Audit custom middleware that calls server.transformIndexHtml and sanitize the URL before passing it in.
• Restrict the Vite development server to loopback interfaces during local development to limit remote reachability.

Patch Information

The fix is delivered in Vite 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3. Technical details are documented in the GitHub Security Advisory GHSA-9jrq-w75r-8gcw, the ViteJS Pull Request #23653, and the ViteJS Commit Update.

Workarounds

• Strip query strings and normalize leading slashes from req.url before invoking transformIndexHtml in custom middleware.
• Avoid using inline <script type="module"> blocks in HTML files served through the development server until patched.
• Bind the Vite dev server to 127.0.0.1 and disable --host exposure to prevent attacker-reachable sessions.

# Configuration example: upgrade Vite and restrict dev server to loopback
npm install vite@^8.3.3
# vite.config.ts
# export default { server: { host: '127.0.0.1', strictPort: true } }