Aller au contenu
en Se connecter
6.3 Moyenne

CVE-2026-112946 Vite is a frontend tooling framework for JavaScript

Description

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.

Produits et versions touchés

Produit Versions touchées Corrigé en
vite 8.3 8.3.0 → < 8.3.3 8.3.3
vite 8.2 8.2.0 → < 8.2.4 8.2.4
vite 8.0 8.0.0 → < 8.1.6 8.1.6
vite 7.0 7.0.0 → < 7.3.7 7.3.7
vite 6.4 premières → < 6.4.4 6.4.4
vite-plus 1.1 premières → < 1.1.0 1.1.0

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de vite

Les 28 CVE de vite →
CVE-2026-118662 Vite is a frontend tooling framework for JavaScript 6.9 Moyenne CVE-2026-112947 Vite is a frontend tooling framework for JavaScript 6.3 Moyenne CVE-2026-112945 Vite is a frontend tooling framework for JavaScript 2.1 Faible CVE-2026-112944 launch-editor allows users to open files with line numbers in editor from Node.js 6.3 Moyenne
Suivre cette CVE