CVE-2026-118662: CVE-2026-118662: Access Control Bypass via Uncanonicalized Query Parameters in Vite Development Server

#security #cve #cybersecurity

CVE-2026-118662: Access Control Bypass via Uncanonicalized Query Parameters in Vite Development Server

Vulnerability ID: CVE-2026-118662
CVSS Score: 6.9
Published: 2026-10-29

CVE-2026-118662 (also tracked as GHSA-8g5g-mxqh-grgj) is an improper access control and path canonicalization vulnerability in the Vite frontend build and development tool. In version 6.4.4, the Vite development server fails to strip transform and loader query parameters before evaluating file paths against the server.fs.deny configuration directive. When the development server is exposed to a network and sensitive files located within server.fs.allow match patterns in server.fs.deny, an unauthenticated remote attacker can bypass file access restrictions by appending specific query strings such as ?raw or ?inline to HTTP requests. This allows arbitrary retrieval of restricted files, including environment configuration files and private cryptographic keys.

TL;DR

Vite 6.4.4 evaluates server.fs.deny file access restrictions before stripping URL query parameters in its transform middleware. Unauthenticated attackers with network access to an exposed Vite development server can append query parameters like ?raw or ?import&raw to bypass the denylist and read sensitive files such as .env located within allowed project directories. Upgrading to Vite 6.4.5 resolves the issue.

⚠️ Exploit Status: POC

Technical Details

CVE ID: CVE-2026-118662 (GHSA-8g5g-mxqh-grgj)
Weakness Class: CWE-180 (Validate Before Canonicalize) / CWE-284 (Improper Access Control)
CVSS v4.0 Score: 6.9 Medium (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N)
Attack Vector: Network (HTTP GET request with transform query parameters)
Affected Versions: Vite >= 6.4.4, < 6.4.5
Patched Version: Vite 6.4.5
EPSS Score: 0.295% (22.10th percentile)
CISA KEV Status: Not Listed

Affected Systems

Vite (npm package vite) version 6.4.4
vite: >= 6.4.4, < 6.4.5 (Fixed in: 6.4.5)

Code Analysis

Commit: 91e40d7

fix: check server.fs after stripping query as well (#22160) (#23855)

--- a/packages/vite/src/node/server/middlewares/transform.ts
+++ b/packages/vite/src/node/server/middlewares/transform.ts
@@ -58,7 +58,10 @@ export function isServerAccessDeniedForTransform(
   id: string,
 ): boolean {
   if (rawRE.test(id) || urlRE.test(id) || inlineRE.test(id) || svgRE.test(id)) {
-    return checkLoadingAccess(config, id) !== 'allowed'
+    return (
+      checkLoadingAccess(config, cleanUrl(id)) !== 'allowed' ||
+      checkLoadingAccess(config, id) !== 'allowed'
+    )
   }
   return false
 }

Exploit Details

GitHub (Vite Upstream Regression Tests): Official patch commit containing test cases in playground/fs-serve/__tests__/deny/fs-serve-deny.spec.ts and commonTests.ts demonstrating server.fs.deny bypasses via ?raw, ?import&raw, and ?.svg?import.

Mitigation Strategies

Upgrade Vite to patched version 6.4.5 or later to ensure URL query parameters are stripped prior to server.fs.deny evaluation.
Bind Vite development servers exclusively to the loopback interface (127.0.0.1) rather than all network interfaces (0.0.0.0).
Scope server.fs.allow narrowly to explicit client asset directories (e.g., src/, public/) instead of the top-level workspace root containing .env and .git.
Never deploy the Vite development server (vite dev) in production or internet-facing environments; compile static assets using vite build and serve them via a hardened production HTTP server.

Remediation Steps:

Audit project lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock) to identify instances of vite version 6.4.4.
Run npm install vite@^6.4.5 --save-dev (or the equivalent pnpm/yarn command) to update to the patched release.
Inspect package.json scripts and vite.config.js / vite.config.ts to remove unnecessary --host flags or server.host: true settings.
If any Vite 6.4.4 development server was exposed to an untrusted network, rotate all secrets, API keys, and credentials stored in project .env* files.

References

Read the full report for CVE-2026-118662 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community