Information Disclosure Vulnerability in Vite Frontend Tooling Framework
CVE-2026-112947
6.3MEDIUM
What is CVE-2026-112947?
A vulnerability exists in Vite frontend tooling that allows sensitive information to be leaked. Specifically, it pertains to the retrieval of the first 4 bytes of files located outside of specified server settings when a request with the query parameter ?vite-wasm-instance is made. This issue arises due to inadequate security checks, allowing unauthorized file access. If the file read results in a parsing error, the error generates an output that includes the first 4 bytes of the inaccessible file, thus exposing potentially sensitive data. The vulnerability has been addressed in versions 8.2.4 and 8.3.3.
Affected Version(s)
vite >= 8.3.0, < 8.3.3 < 8.3.0, 8.3.3
vite >= 8.2.0, < 8.2.4 < 8.2.0, 8.2.4
vite-plus >= 0.2.8, < 1.1.0