CVE-2026-112946: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in vitejs vite

CVE-2026-112946 is a path traversal vulnerability in vitejs vite affecting versions prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3. The vulnerability arises because import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, this can allow an imported project file whose URL matches an absolute host path to authorize a subsequent raw filesystem request for that host file outside the project root, provided server.fs.deny does not block it. The vulnerability does not allow arbitrary path traversal since the host path must correspond to a project-relative URL authorized by the application graph. The issue is resolved in the fixed versions.

An attacker on a network-accessible, non-Windows development server could exploit this vulnerability to access files outside the project root that correspond to authorized project-relative URLs. This may lead to unauthorized disclosure of files on the server filesystem. However, arbitrary path traversal is not possible, limiting the scope of the impact.

Upgrade vite to version 6.4.4, 7.3.7, 8.1.6, 8.2.4, or 8.3.3 or later where this issue is fixed. Additionally, ensure that server.fs.deny is properly configured to block unauthorized filesystem access. No other specific mitigations are indicated by the vendor advisory.