Summary
Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machine
The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root. For example, if the project references <path-to-project-root>/etc/hosts, the content of /etc/hosts was possible to be returned.
The content of files outside the server.fs.allow option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing <project-root>/etc/hosts could make Vite return the host's /etc/hosts file.
Details
When Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as /etc/hostname. In affected versions, Vite converts that URL with fsPathFromUrl and adds the result to safeModulePaths. Because fsPathFromUrl ensures a leading slash without resolving the URL against the project root, the project URL /etc/hostname is recorded as if it were the absolute filesystem path /etc/hostname.
For a later request to /@fs/etc/hostname, the raw-filesystem middleware interprets /etc/hostname as an absolute path. The access check applies server.fs.deny, then accepts paths present in safeModulePaths before checking server.fs.allow. As a result, the request can return the host file instead of the project file that originally populated safeModulePaths.
PoC
The following example requires Linux with a readable /etc/hostname:
$ mkdir vite-safe-module-path-poc
$ cd vite-safe-module-path-poc
$ npm init -y
$ npm install [email protected]
$ mkdir -p etc
$ echo 'PROJECT-DECOY\n' > etc/hostname
$ echo 'import "./etc/hostname"\n' > main.js
$ npx vite --host 127.0.0.1
In another terminal:
$ curl -o /dev/null -s -w '%{http_code}\n' http://127.0.0.1:5173/main.js
200
$ curl -sS -o response -w '%{http_code}\n' http://127.0.0.1:5173/@fs/etc/hostname
200
$ cmp -s response /etc/hostname && echo 'response matches host file'
response matches host file
Impact
Only apps that meet all of the following conditions are affected:
- explicitly expose the Vite dev server to the network (using
--hostor theserver.hostoption) - contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host
- The sensitive file is not matched by
server.fs.deny - the dev server is not running on Windows
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
vite to 8.3.3 or later; vite to 8.2.4 or later; vite to 8.1.6 or later; vite to 7.3.7 or later; vite to 6.4.4 or later; vite-plus to 1.1.0 or later
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-112946? CVE-2026-112946 is a medium-severity path traversal vulnerability in vite (npm), affecting versions >= 8.3.0, <= 8.3.2. It is fixed in 8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4, 1.1.0. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
- Which packages are affected by CVE-2026-112946?
vite(npm) (versions >= 8.3.0, <= 8.3.2)vite-plus(npm) (versions <= 1.0.0)
- Is there a fix for CVE-2026-112946? Yes. CVE-2026-112946 is fixed in 8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4, 1.1.0. Upgrade to this version or later.
- Is CVE-2026-112946 exploitable, and should I be worried? Whether CVE-2026-112946 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-112946 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-112946?
- Upgrade
viteto 8.3.3 or later - Upgrade
viteto 8.2.4 or later - Upgrade
viteto 8.1.6 or later - Upgrade
viteto 7.3.7 or later - Upgrade
viteto 6.4.4 or later - Upgrade
vite-plusto 1.1.0 or later
- Upgrade