Vite Frontend Framework Vulnerability Exposes Sensitive Files

CVE-2026-118662

What is CVE-2026-118662?

The Vite development server, from versions 6.4.4 to 6.4.5, has a vulnerability that lacks adequate validation of the server.fs.deny configuration before processing certain loader query parameters. When the server is accessible over the network, an attacker could exploit this issue to retrieve sensitive files listed in the server.fs.allow but also matched by the server.fs.deny. This could allow the unauthorized disclosure of private or confidential information if proper precautions are not taken. The issue has been addressed and resolved in version 6.4.5.

References