Vitejs Vite/Vite-Plus up to 8.2.3/8.3.2 Wasm plugin load hook vite-wasm-instance information disclosure

Summaryinfo

A vulnerability labeled as problematic has been found in Vitejs Vite and Vite-Plus up to 8.2.3/8.3.2. Affected by this issue is the function load hook of the component Wasm plugin. Such manipulation of the argument vite-wasm-instance leads to information disclosure. This vulnerability is uniquely identified as CVE-2026-112947. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Vitejs Vite and Vite-Plus up to 8.2.3/8.3.2 and classified as problematic. Affected by this issue is the function load hook of the component Wasm plugin. The manipulation of the argument vite-wasm-instance with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. CVE summarizes:

Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal Wasm plugin's load hook. The hook removes the query and reads the resulting path directly from disk, but the server.fs checks were not applied. After reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file. This vulnerability is fixed in 8.2.4 and 8.3.3.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-112947 since 10/19/2026. The exploitation is known to be easy. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 8.2.4 or 8.3.3 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Vitejs

Name

• Vite
• Vite-Plus

Version

• 8.2.0
• 8.2.1
• 8.2.2
• 8.2.3
• 8.3.0
• 8.3.1
• 8.3.2

Website

• Product: https://github.com/vitejs/vite/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion