CVE-2026-112945 in Vite
Summary
by MITRE • 10/20/2026
Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in the Vite-served page. This execution can expose sensitive page data or permit critical actions available to the affected application. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in Vite, a popular frontend tooling framework for JavaScript development, represents a significant security risk related to path traversal and unvalidated input handling during the HTML transformation process. This flaw specifically affects versions prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3. The core of the issue lies in how Vite handles custom middleware when processing incoming browser requests for index HTML files. When an application utilizes custom middleware that passes a raw or unchanged browser request URL directly to the server.transformIndexHtml function without sanitization, it creates an opportunity for malicious actors to manipulate the resulting output. This behavior violates fundamental security principles regarding input validation and path resolution, allowing attackers to inject arbitrary paths into the generated HTML content served by the development server.
Technically, the vulnerability stems from the interaction between getHtmlFilename and the handling of query parameters within request URLs. When processing a request, Vite uses the query-bearing URL to resolve an existing local file on the filesystem. Crucially, this process preserves any leading slashes that are present in the attacker-supplied portion of the URL. In standard web development practices, leading double slashes or specific path sequences can be interpreted differently by browsers and servers, often bypassing intended directory restrictions. By preserving these leading slashes in the generated proxy module URL within the transformed HTML, Vite inadvertently creates a mechanism for path manipulation that allows external resources to be referenced as if they were local modules. This technical flaw is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-79: Cross-site Scripting (XSS), specifically involving the injection of executable code through manipulated resource references.
The operational impact of this vulnerability is severe, particularly in development environments where hot module replacement and dynamic script loading are common features. If an attacker can craft a specific URL that includes leading slashes within query parameters or path segments, they can cause Vite to generate HTML containing inline module scripts with maliciously constructed source attributes. When a victim user loads the crafted page through their browser while connected to the vulnerable development server, the browser interprets these manipulated URLs as valid module sources. Consequently, the browser fetches and executes JavaScript code controlled by the attacker from an external or arbitrary location. This execution occurs within the context of the affected application, granting the malicious script access to sensitive page data, cookies, local storage, and other session-specific information that would otherwise be protected by same-origin policies if properly isolated.
Furthermore, because the executed module operates with the privileges of the legitimate application, an attacker can perform critical actions available to the authenticated user or the application itself. This could include modifying application state, exfiltrating confidential data, performing unauthorized transactions, or further propagating attacks within the internal network if the development server has broader access rights than intended. The severity is amplified by the fact that this vulnerability affects multiple major version lines of Vite, indicating a systemic issue in how path resolution and URL handling are implemented across different releases. It highlights the dangers of relying on framework-level abstractions without ensuring strict input sanitization at every layer of request processing.
To mitigate this risk, organizations must immediately upgrade to patched versions of Vite, specifically 6.4.4, 7.3.7, 8.1.6, 8.2.4, or 8.3.3 and later. These releases contain fixes that properly sanitize input URLs before they are used in file resolution and HTML transformation processes, ensuring that leading slashes and other potentially dangerous path characters do not propagate into the generated proxy module URLs. For applications where upgrading is not immediately feasible, developers should implement strict validation of all incoming request parameters within custom middleware. This includes stripping or encoding special characters such as forward slashes before passing them to Vite’s internal transformation functions. Additionally, implementing Content Security Policy headers can help restrict the sources from which scripts are allowed to load, providing a layer of defense-in-depth against script injection attacks even if the underlying framework vulnerability is not yet patched. Regular security audits and static code analysis tools configured to detect improper path handling should also be employed to identify similar vulnerabilities in custom middleware implementations across the application stack.