CVEsvitejsCVE-2026-112945Published Oct 20, 15:00 · Updated Oct 28, 14:11 UTC
2.1
LowCVSS 4.0 · from GitHub_M
CVE-2026-112945

Vite: Cross origin script execution through Vite custom middleware

vite · CWE-80 · CWE-80
Affectedvite, vite-plus
FixNo fix listed yet.
PublishedOct 20, 15:00 · GitHub_M
ScoredOct 20 · 2.1 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC

What we know

No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Someone has to open, click or run something first. CVSS: user interaction required.

Description

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in the Vite-served page. This execution can expose sensitive page data or permit critical actions available to the affected application. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.

From GitHub_M

Affected and fixed versions

ProductAffectedFixed invite>= 8.3.0, < 8.3.3–vite>= 8.2.0, < 8.2.4–vite>= 8.0.0, < 8.1.6–vite>= 7.0.0, < 7.3.7–vite< 6.4.4–vite-plus< 1.1.0–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

github.com/vitejs/vite/security/advisories/GHSA-9jrq-w75r-8gcw · github.comrefsource_CONFIRMgithub.com/vitejs/vite/pull/23653 · github.comrefsource_MISCgithub.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17 · github.comrefsource_MISC

Other CVEs in vite

All 22 →
6.9Vite: `server.fs.deny` bypassed with queries · CVE-2026-118662Oct 286.3Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` · CVE-2026-112947Oct 206.3Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine · CVE-2026-112946Oct 20