Medium severity · published Oct 28, 2026
CVE-2026-118662
Vite: `server.fs.deny` bypassed with queries
New
6.9
CVSS
–
EPSS
No
On KEV
Description
Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
vite · vitejs
>= 6.4.4, < 6.4.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118662
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118662
x_refsource_CONFIRM
https://github.com/vitejs/vite/security/advisories/GHSA-8g5g-mxqh-grgj
x_refsource_MISC
https://github.com/vitejs/vite/pull/22160
x_refsource_MISC
https://github.com/vitejs/vite/pull/23855
x_refsource_MISC
https://github.com/vitejs/vite/commit/91e40d7bf9777057bbd31c3eb036a54c9465697e
x_refsource_MISC
https://github.com/vitejs/vite/releases/tag/v6.4.5
More from vite
7.5
CVE-2025-31125
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
8.3
CVE-2024-52011
launch-editor vulnerable to command injection via the crafted request on Windows
7.5
CVE-2026-112942
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
7.5
CVE-2026-53571
Vite: `server.fs.deny` bypass on Windows alternate paths
7.5
CVE-2026-39364
Vite has a `server.fs.deny` bypass with queries