Vite EUVD-2026-112469

Exploitation requires all of the following, per the advisory: (1) the Vite dev server is explicitly exposed to the network using --host or the server.host config option; (2) the targeted sensitive file resides inside a directory permitted by server.fs.allow; and (3) that file is matched by a server.fs.deny pattern (e.g. .env, *.crt). When these hold, an unauthenticated network attacker appends a loader query such as ?raw, ?import&raw, or ?import&url&inline to the denied path and receives the file with HTTP 200. Limiting factors that reduce real-world risk: the dev server is not network-exposed in its default configuration, so default local-only development is not affected; only the production dev server of Vite 6.4.4 is vulnerable (6.4.5 fixes it); and impact is confined to disclosure of files that are both allowed and denied - no code execution or modification.

This is a moderate-severity information-disclosure flaw (vendor CVSS 4.0 base 6.9) whose real-world risk is tightly bounded by its preconditions rather than by raw reachability. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VC:L, SC:H) indicates a network-reachable, low-complexity, unauthenticated issue, and PR:N confirms no authentication is required. However, the AT:P (attack requirements present) metric and the advisory both make clear exploitation is not possible against a default deployment: the Vite dev server must be deliberately exposed to the network, and a sensitive file must simultaneously sit inside server.fs.allow yet be matched by server.fs.deny. No EPSS score and no CISA KEV entry were provided, and there is no confirmed working exploit in the inputs, so there is no signal of active or widespread exploitation. The vuln.today decision label is 'this_month', consistent with a real but non-emergency fix priority. The signals are internally consistent: a network unauthenticated vector tempered by a non-default configuration requirement and limited (confidentiality-only) impact. The main point to verify independently is scope of impact - the vendor rated vulnerable-system confidentiality as Low but subsequent-system confidentiality as High, reflecting that the leaked file (e.g. .env secrets, TLS keys) can enable compromise elsewhere; treat the practical impact as potentially high where the denied files hold credentials.

An organization runs the Vite 6.4.4 development server bound to the network (via --host or server.host) and relies on server.fs.deny to block files such as .env or *.crt that live inside an allowed directory. An unauthenticated attacker who can reach the dev server requests the denied path with a loader query appended (e.g. GET /.env?raw), the deny check is evaluated before the query is stripped, and the server returns the file contents with HTTP 200. No public working exploit is identified in the provided data, though the advisory fully describes the technique.