CVE-2026-118662
Description
Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.
Is your site exposed to CVE-2026-118662?
Run a free security scan — no signup, results in seconds.
Weakness Type (CWE)
References
Other References
Frequently Asked Questions
What is CVE-2026-118662? +
How do I check if I'm vulnerable to CVE-2026-118662? +
Related Vulnerabilities
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed …
`zip` is a zip library for rust which supports reading and writing of simple ZIP files. In the archive extraction …
PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because …
The cohttp package before 6.3.0 for OCaml allows directory traversal.
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an …
A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious …