Vite CVE-2026-112945

Exploitation requires a specific non-default deployment: the application must use custom middleware that passes an unchanged browser request URL directly into server.transformIndexHtml, AND this affects only the Vite DEVELOPMENT server (not production builds). The transformed HTML must contain an inline module <script>, and the request URL must carry attacker-controlled leading double slashes (protocol-relative, e.g. //evil.example.com/...). Limiting factors: a victim developer/user must actively load the attacker-crafted dev-server page (UI:A), the vulnerable custom-middleware pattern must be present (AT:P - not Vite's default behavior), and exposure is confined to the local development environment rather than deployed production assets.

Real-world risk is LOW, and the signals are largely consistent on this. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N) yields a base score of only 2.1: although the attack vector is network-facing and requires no authentication (PR:N), it carries AT:P (a specific attack requirement must be met) and UI:A (the victim must actively load a crafted page), with only Low confidentiality and integrity impact and no availability impact. Critically, this is a flaw in Vite's DEVELOPMENT server, not production builds, and it only manifests when an application deploys custom middleware that forwards an unchanged browser request URL into server.transformIndexHtml - a non-default coding pattern. No EPSS score was supplied in the input and the CVE is not on CISA KEV; there is no public exploit identified at time of analysis (no POC flag set), only a security advisory and the fixing PR/commit. The signals do not conflict: a genuinely low CVSS aligns with the absence of KEV/POC and the narrow, developer-environment-only exposure. This is a legitimate XSS (CWE-80) worth patching during normal maintenance, but it is NOT a widespread-exploitation priority - treat it as a low-severity hygiene fix rather than an emergency.

A developer runs a Vite dev server behind custom middleware that passes the raw request URL into transformIndexHtml. An attacker lures that developer into opening a crafted dev-server URL beginning with a double slash (e.g. //evil.example.com/payload.js?...); Vite preserves the leading slashes, producing a protocol-relative proxy module URL in an inline <script>. The victim's browser then fetches and executes the attacker-hosted module within the Vite-served page, exposing page data or performing actions available to the app. No public exploit is identified at time of analysis, though the fixing PR includes regression tests demonstrating the vector.