Vulnerability in Vite Framework Exposes Applications to Code Execution Risks
CVE-2026-112945
2.1LOW
What is CVE-2026-112945?
Prior to specified versions, the Vite framework is susceptible to a code execution vulnerability due to improper handling of modified browser request URLs in custom middleware. When a victim's browser interacts with a crafted development server page containing an inline module script, it may inadvertently fetch and execute attacker-controlled module code. This exploit can expose sensitive data or enable unauthorized actions within the application, underlining the importance of updating to the latest versions to mitigate these risks.
Affected Version(s)
vite >= 8.3.0, < 8.3.3 < 8.3.0, 8.3.3
vite >= 8.2.0, < 8.2.4 < 8.2.0, 8.2.4
vite >= 8.0.0, < 8.1.6 < 8.0.0, 8.1.6