CVE-2026-112947Medium· 6.3▾ SunlitVite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.4%
0.4% → 0.5%
The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance.
Only apps that match one of the following conditions are affected:
--host or the server.host optionRequests containing the ?vite-wasm-instance query are handled by the internal Wasm plugin's load hook. The hook removes the query and reads the resulting path directly from disk, but the server.fs checks were not applied.
After reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file.
Create a denied file and start an affected Vite dev server:
echo 'SECRET_KEY=abc123\n' > .env
npm run dev
curl 'http://localhost:5173/.env?vite-wasm-instance'
This will show
Failed to parse WASM file "<root>/.env": WebAssembly.compile(): expected magic word 00 61 73 6d, found 53 45 43 52 @+0
vite >= 8.3.0, <= 8.3.2vite >= 8.2.0, <= 8.2.3vite-plus >= 0.2.8, <= 1.0.0Upgrade to a patched release:
vite 8.3.3vite 8.2.4vite-plus 1.1.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-53571Mediumvite: `server.fs.deny` bypass on Windows alternate paths
CVE-2026-112946Medium· 6.3Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
CVE-2026-112945Low· 2.1Vite: Cross origin script execution through Vite custom middleware
CVE-2025-58752Medium· 5.3Vite is a frontend tooling framework for JavaScript
CVE-2026-39363High· 7.5Vite is a frontend tooling framework for JavaScript
CVE-2026-118662MediumVite: `server.fs.deny` bypassed with queries