CVE-2026-118662 in Vite
Summary
by MITRE • 10/28/2026
Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within Vite versions ranging from 6.4.4 to 6.4.5 represents a critical logic flaw in the development server's request handling pipeline, specifically concerning the order of operations for security checks versus query parameter processing. Vite is widely utilized as a modern frontend build tool and development server that provides hot module replacement and optimized bundling capabilities. In this specific context, the developer configuration allows administrators to define two distinct lists: one containing files or directories explicitly allowed for access via server.fs.allow, and another listing paths that should be strictly denied via server.fs.deny. The intended security model relies on these deny rules acting as a final gatekeeper to prevent unauthorized access to sensitive system files, such as environment variables, configuration secrets, or internal source code, even if those resources reside within broader directories that are generally permitted for serving static assets.
The technical root cause of this vulnerability lies in the sequence of operations performed by the Vite development server when processing incoming HTTP requests. When a client requests a resource, the server is supposed to first evaluate whether the requested path falls under the restrictions defined in server.fs.deny before proceeding with any further parsing or transformation logic. However, due to an implementation oversight, the server processes loader query parameters such as ?raw, ?import&raw, and ?import&url&inline prior to applying these filesystem deny checks. These query parameters instruct Vite's internal loaders to treat the requested file in specific ways, such as returning its content as a raw string or embedding it directly into JavaScript code. By stripping or processing these queries before validating the access control list, the server inadvertently bypasses the security boundary established by the deny rules.
This architectural flaw creates a significant operational impact for developers who expose their Vite development servers to local networks or external environments during testing and debugging phases. An unauthenticated attacker can exploit this race condition in logic execution by appending specific query strings to URLs of files that are technically located within directories listed in server.fs.allow but explicitly blocked by server.fs.deny. For instance, if a sensitive configuration file is inside an allowed directory but marked as denied, the attacker does not need to bypass the deny rule directly; instead, they simply append ?raw or similar loaders to the URL request. The server then processes this modified request through its loader pipeline first, successfully retrieving and returning the contents of the restricted file before the security check can intervene. This results in a clear information disclosure vulnerability where sensitive data is exposed without authentication.
From an industry standards perspective, this flaw aligns with CWE-20 Improper Input Validation, as the system fails to properly validate the integrity of the access control decision relative to input modifications like query parameters. It also relates closely to CWE-16 Configuration, indicating a failure in the secure configuration of file serving rules where the order of evaluation compromises security intent. In terms of the MITRE ATT&CK framework, this vulnerability facilitates reconnaissance and data exfiltration through techniques associated with Tactic TA0009 Collection or potentially TA0005 Defense Evasion if used to bypass application-level controls. The attack vector is classified as Network-based (T1078) requiring no user interaction beyond sending a crafted HTTP request, making it particularly dangerous in development environments that are inadvertently left accessible on open networks.
To mitigate this risk and prevent similar issues in future releases, the primary remediation is to upgrade immediately to Vite version 6.4.5 or later, where the logic has been corrected to ensure that filesystem deny rules are evaluated before any loader query parameters are processed. For organizations unable to patch immediately, strict network segmentation of development servers is recommended; these services should never be exposed beyond localhost unless absolutely necessary and protected by additional reverse proxy authentication mechanisms. Furthermore, developers should adopt a principle of least privilege in their Vite configurations, ensuring that server.fs.deny includes all sensitive paths regardless of the broader allow list, and regularly auditing configuration files to ensure no critical secrets are stored within directories permitted for public access during development.