Frontend Tooling Framework Vulnerability Affecting Vite by Vite.js
CVE-2026-53571
Key Information:
Badges
What is CVE-2026-53571?
The vulnerability in Vite, a widely-used frontend tooling framework for JavaScript, poses a significant security risk on Windows systems. Prior to specific versions (8.0.16, 7.3.5, and 6.4.3), the server.fs.deny configuration meant to prevent access to sensitive files can be bypassed. Due to improper normalization of NTFS Alternate Data Streams (ADS), unauthorized access to files such as .env and security certificates can occur. The flaw arises when certain requests, treated incorrectly as allowed paths, expose sensitive information in the file system, especially when utilizing legacy file name compatibility on Windows. Affected users are urged to update to the latest versions to safeguard against this vulnerability.
Affected Version(s)
vite >= 8.0.0, < 8.0.16 < 8.0.0, 8.0.16
vite >= 7.0.0, < 7.3.5 < 7.0.0, 7.3.5
vite < 6.4.3 < 6.4.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.