Improper Input Validation in Vite Framework for JavaScript

CVE-2026-112946

What is CVE-2026-112946?

The Vite framework for JavaScript contained a vulnerability related to import analysis prior to specific versions. This flaw allowed an improperly constructed project file's URL to be recorded in the safeModulePaths, potentially leading to unauthorized disclosure of files outside the designated project root. If a development server was accessible over the network and configured without appropriate restrictions, this vulnerability could allow access to sensitive files. However, the design of the application graph limited the extent of this issue, as arbitrary path traversal was not permitted.

References