CVE-2026-112945: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in vitejs vite

CVE-2026-112945 is an improper neutralization of script-related HTML tags (CWE-80) vulnerability in Vite. When custom middleware passes an unchanged browser request URL to server.transformIndexHtml, the function getHtmlFilename uses this query-bearing URL to resolve local files but preserves leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script, the leading double slash causes the browser to fetch and execute an attacker-controlled module. This can lead to exposure of sensitive page data or execution of critical actions within the affected application. The vulnerability is addressed in Vite versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.

Successful exploitation allows an attacker to execute arbitrary module scripts in the context of the development server page, potentially exposing sensitive data or enabling critical actions accessible to the application. The CVSS 4.0 base score is 2.1, indicating low severity with network attack vector, low complexity, partial attack and user interaction required, and low impact on confidentiality and integrity.

This vulnerability is fixed in Vite versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3. Users should upgrade to these or later versions to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.