Vite CVE-2026-112946

Requires a Vite development server (not a production build) that is (1) network-accessible rather than bound to the default localhost, (2) running on a non-Windows host, and (3) configured such that server.fs.deny does not block the target file. Additionally, an imported project file must have a root-relative browser URL that collides with an absolute host filesystem path, causing that path to be recorded in safeModulePaths; only files matching such application-graph-authorized URLs can be disclosed. Limiting factors: Windows hosts are unaffected; arbitrary path traversal is NOT possible (the host path must correspond to a project-relative URL); default localhost binding prevents remote reach; and the impact is confined to read disclosure of a single matching file outside the project root, with no integrity or availability effect.

This is a limited information-disclosure flaw in Vite's dev server, not a high-priority emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N) scores 6.3 (Medium) and is internally consistent with the description: network reachable (AV:N), unauthenticated (PR:N), no user interaction, but with an attack requirement (AT:P) reflecting that a specific URL/host-path collision must exist, and only Low confidentiality impact with zero integrity or availability impact. No EPSS score, no CISA KEV listing, and no public exploit were supplied, so exploitation status is 'no public exploit identified at time of analysis.' The GitHub advisory and patch commits confirm the bug and fix, but the source evidence provided is the vendor's remediation (PR #23656 and regression tests), not a weaponized attacker tool. The realistic risk is materially constrained by three gating conditions stated in the description - the dev server must be network-accessible (Vite binds to localhost by default), the host must be non-Windows, and server.fs.deny must not already block the target - and by the fact that it does NOT permit arbitrary path traversal (the disclosed host path must correspond to a project-relative URL authorized by the application graph). Net: a genuine but low-to-medium development-environment exposure, worth patching promptly where dev servers are exposed on a network, but not comparable to a remotely exploitable production RCE despite the 'network' vector.

A developer exposes a Vite dev server on a network interface (e.g. server.host set for LAN/container testing) on a non-Windows machine. An attacker who can reach that server issues a raw filesystem (@fs) request for a host path that collides with a root-relative module URL recorded in safeModulePaths, and if server.fs.deny does not block it, Vite returns the contents of that host file located outside the project root. No public exploit code was provided, and the attacker cannot traverse to arbitrary paths - only files matching an application-graph-authorized URL are disclosed.