CVE-2026-112947: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in vitejs vite

Vite, a JavaScript frontend tooling framework, has a path traversal vulnerability (CWE-22) in versions >=8.2.0 <8.2.4 and >=8.3.0 <8.3.3. When handling requests containing the ?vite-wasm-instance query, the internal Wasm plugin's load hook removes the query and reads the file path directly from disk without applying server.fs directory restrictions. If the file read fails to parse as WebAssembly, an error is thrown by Node or Deno that leaks the first 4 bytes of the file. This information disclosure vulnerability is resolved in versions 8.2.4 and 8.3.3.

An attacker can obtain the first 4 bytes of arbitrary files outside the restricted server.fs directory by sending specially crafted requests. This partial information disclosure could aid in reconnaissance but does not directly lead to full file content exposure or code execution. The CVSS 4.0 score is 6.3 (medium severity), reflecting network attack vector, low complexity, and partial information disclosure.

Upgrade Vite to version 8.2.4 or later in the 8.2.x series, or 8.3.3 or later in the 8.3.x series to apply the official fix. No other mitigation is required as the vulnerability is resolved in these versions.