Most recent entries from all

BREW-vite-CVE-2026-112946 — Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

2026-10-23T08:09:43.525895+00:00

Affected: Homebrew: vite

### Summary

The content of files outside `server.fs` setting can be returned to the browser if the project imports a file path concatenated with the `root`. For example, if the project references `/etc/hosts`, the content of `/etc/hosts` was possible to be returned.

The content of files outside the `server.fs.allow` option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing `/etc/hosts` could make Vite return the host's `/etc/hosts` file.

### Impact

Only apps that meet all of the following conditions are affected:

- explicitly expose the Vite dev server to the network (using `--host` or the [`server.host` option](https://vite.dev/config/server-options#server-host)) - contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host - The sensitive file is not matched by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) - the dev server is not running on Windows

### Details

When Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as `/etc/hostname`. In affected versions, Vite converts that URL with `fsPathFromUrl` and adds the result to `safeModulePaths`. Because `fsPathFromUrl` ensures a leading slash without resolving the URL against the project root, the project URL `/etc/hostname` is recorded as if it were the absolute filesys…

fkie_cve-2026-112946

2026-10-23T08:09:43.526383+00:00

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.

GHSA-rq7h-c2jc-7f22 — Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

2026-10-23T08:09:43.526573+00:00

Affected: npm: vite, npm: vite-plus

### Summary

### Impact

Only apps that meet all of the following conditions are affected:

### Details