CVE-2026-118662
Vite: `server.fs.deny` bypassed with queries
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.
| CWE | CWE-180 CWE-284 |
| Vendor | vitejs |
| Product | vite |
| Published | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for vitejs vite
Be the first to know when new unknown vulnerabilities affecting vitejs vite are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
vitejs / vite
>= 6.4.4, < 6.4.5
References
github.com: https://github.com/vitejs/vite/security/advisories/GHSA-8g5g-mxqh-grgj github.com: https://github.com/vitejs/vite/pull/22160 github.com: https://github.com/vitejs/vite/pull/23855 github.com: https://github.com/vitejs/vite/commit/91e40d7bf9777057bbd31c3eb036a54c9465697e github.com: https://github.com/vitejs/vite/releases/tag/v6.4.5