CVE-2026-118662

— UNSCOREDpublic exploit available

Published 2026-10-28 · Updated 2026-10-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.

Weaknesses

CWE-180, CWE-284

Public exploit & PoC references

https://github.com/vitejs/vite/commit/91e40d7bf9777057bbd31c3eb036a54c9465697e
https://github.com/vitejs/vite/pull/22160
https://github.com/vitejs/vite/pull/23855
https://github.com/vitejs/vite/releases/tag/v6.4.5
https://github.com/vitejs/vite/security/advisories/GHSA-8g5g-mxqh-grgj

All references

https://github.com/vitejs/vite/commit/91e40d7bf9777057bbd31c3eb036a54c9465697e
https://github.com/vitejs/vite/pull/22160
https://github.com/vitejs/vite/pull/23855
https://github.com/vitejs/vite/releases/tag/v6.4.5
https://github.com/vitejs/vite/security/advisories/GHSA-8g5g-mxqh-grgj

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2013-10077PoC
MEDIUMCVE-2023-54412PoC
CRITICALCVE-2024-34320
HIGHCVE-2025-70962PoC
HIGHCVE-2026-100114
HIGHCVE-2026-100115
MEDIUMCVE-2026-100230PoC
HIGHCVE-2026-100409PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.