CVE-2026-112946: Vite Path Traversal Vulnerability

CVE-2026-112946 Overview

CVE-2026-112946 affects Vite, a frontend tooling framework for JavaScript used widely in modern web development workflows. The vulnerability resides in the development server's import analysis logic, which records a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On network-accessible, non-Windows development servers, this confusion allows a later raw-filesystem request to disclose a file outside the project root. The flaw is classified under CWE-22 (Path Traversal), though the scope is constrained by the application's import graph.

Critical Impact

An attacker with network access to a running Vite development server can read specific host files outside the project root when their path matches an imported project-relative URL and server.fs.deny does not block the request.

Affected Products

• Vite versions prior to 6.4.4
• Vite 7.x prior to 7.3.7
• Vite 8.x prior to 8.1.6, 8.2.4, and 8.3.3

Discovery Timeline

• 2026-10-20 - CVE-2026-112946 published to NVD
• 2026-10-20 - Last updated in NVD database
• Vendor fix tracked in Vite Pull Request #23656 and GitHub Security Advisory GHSA-rq7h-c2jc-7f22

Technical Details for CVE-2026-112946

Vulnerability Analysis

The vulnerability is a path confusion issue in Vite's import analysis plugin. When Vite processes an imported module, it tracks safe filesystem paths in a safeModulePaths set used to authorize later raw-filesystem requests. Before the patch, the import analysis code stored a root-relative browser URL instead of the cleaned, resolved module identifier. On non-Windows development servers, these URLs can be structurally indistinguishable from absolute host filesystem paths. An attacker who reaches the development server over the network can then request that host path through the raw-filesystem endpoint. Because the URL was previously added to safeModulePaths, the server authorizes the read and returns the contents of the matching host file.

Root Cause

The root cause lies in packages/vite/src/node/plugins/importAnalysis.ts, where the plugin added URLs rather than resolved identifiers to safeModulePaths. The patch removes the fsPathFromUrl conversion path and instead stores the resolved module id directly, eliminating the semantic overlap between browser URL space and host filesystem space.

Attack Vector

Exploitation requires network reachability to a Vite development server running on a non-Windows host. The attacker must identify or trigger an import whose project-relative URL matches an absolute host path, then issue a raw-filesystem request for that path. The server.fs.deny configuration must not block the target file. The impact does not extend to arbitrary path traversal; the host path must correspond to a project-relative URL already authorized by the application graph.

// Patch excerpt: packages/vite/src/node/plugins/importAnalysis.ts
 import type { TransformPluginContext } from '../server/pluginContainer'
 import {
   createDebugger,
-  fsPathFromUrl,
   generateCodeFrame,
   getFileStartIndex,
   getHash,

Source: Vite Commit 170b927

// Regression test plugin demonstrating the confusion scenario
// playground/fs-serve/root/safeModulePathPlugin.ts
import path from 'node:path'
import type { Plugin } from 'vite'

const playgroundRoot = path.dirname(import.meta.dirname).replace(/\\/g, '/')
const targetRoot = playgroundRoot.replace(/^[A-Z]:/i, '')
const target = path.posix.join(targetRoot, 'root/unsafe.txt')
const decoyId = path.posix.join(import.meta.dirname.replace(/\\/g, '/'), target)

export default function safeModulePathPlugin(): Plugin {
  return {
    name: 'safe-module-path',
    enforce: 'pre',
    resolveId(id) {
      if (id === 'virtual:safe-module-path-confusion') {
        return decoyId
      }
    },
    load(id) {
      if (id === decoyId) {
        return 'export {}'
      }
    },
  }
}

Source: Vite Commit 170b927

Detection Methods for CVE-2026-112946

Indicators of Compromise

• Unexpected HTTP requests to the Vite development server's /@fs/ raw filesystem endpoint referencing absolute host paths
• Development server access logs showing requests from non-local IP addresses
• Successful file reads outside the configured project root in Vite server logs

Detection Strategies

• Audit Vite dependency versions across developer workstations and CI runners using software composition analysis
• Inspect reverse-proxy and container logs fronting development servers for anomalous /@fs/ request patterns
• Flag any Vite dev server bound to non-loopback interfaces (for example, host: true or --host 0.0.0.0) on non-Windows systems

Monitoring Recommendations

• Monitor outbound exposure of development ports (typically 5173) at network boundaries and in cloud security groups
• Alert on dev server processes listening on public interfaces using endpoint telemetry
• Review server.fs.deny and server.fs.allow configurations in vite.config.ts across repositories for permissive patterns

How to Mitigate CVE-2026-112946

Immediate Actions Required

• Upgrade Vite to a patched release: 6.4.4, 7.3.7, 8.1.6, 8.2.4, or 8.3.3 depending on the major version in use
• Bind Vite development servers to localhost only until the upgrade is confirmed across all development environments
• Review server.fs.deny configuration to ensure sensitive host paths are explicitly denied

Patch Information

The fix is implemented across Vite pull request #23656 and backported in commits 170b927, 45c0e33, c3e06f9, e570d8d, and f0d76c7. The patch removes the use of fsPathFromUrl in import analysis and stores resolved module identifiers in safeModulePaths instead of URLs. See the GitHub Security Advisory GHSA-rq7h-c2jc-7f22 for full details.

Workarounds

• Keep the Vite development server bound to 127.0.0.1 and avoid using --host flags that expose it to the network
• Tighten server.fs.deny to block sensitive files that could overlap with project-relative URL paths
• Use SSH tunneling or VPN access instead of exposing the dev server directly when remote preview is required

# vite.config.ts hardening example
# export default defineConfig({
#   server: {
#     host: '127.0.0.1',
#     fs: {
#       strict: true,
#       deny: ['.env', '.env.*', '*.{crt,pem,key}', 'id_rsa', '**/.git/**'],
#     },
#   },
# })
npm install vite@8.3.3 --save-dev