Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112947— Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

Quick assessment

Affected
vitejs vite
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Vite 是一个面向 JavaScript 的前端工具框架。在版本 8.2.0 至 8.2.4 以及 8.3.3 中，攻击者可通过在请求中添加 查询参数，使服务器返回位于 配置范围之外的文件的前 4 个字节。包含该查询参数的请求由内部 Wasm 插件的 钩子处理。该钩子会移除查询参数，并直接从磁盘读取剩余路径所指向的文件，但并未应用 的安全检查。文件读取后，Vite 会尝试将其解析为 WebAssembly 模块；当解析失败时，Node.js 和 Deno 会抛出包含该文件前 4 个字节的错误信息，从而导致敏感数据

CVSS 6.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112947

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Source: CVE Program / CVE List V5
Vulnerability Description
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal Wasm plugin's load hook. The hook removes the query and reads the resulting path directly from disk, but the server.fs checks were not applied. After reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file. This vulnerability is fixed in 8.2.4 and 8.3.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
vitejs vite >= 8.3.0, < 8.3.3 -
vitejs vite-plus >= 0.2.8, < 1.1.0 -

II. Public POCs for CVE-2026-112947

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112947

请登录查看更多情报信息。

Other References for CVE-2026-112947 (4)

Same Patch Batch · vitejs · 2026-10-20 · 6 CVEs total

CVE-2026-112942 7.5 HIGH launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
CVE-2026-112944 6.3 MEDIUM launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for s
CVE-2026-112943 6.3 MEDIUM launch-editor: escapeCmdArgs() omits % escaping on Windows
CVE-2026-112946 6.3 MEDIUM Vite: Files outside `server.fs.allow` could be served when project paths match system path
CVE-2026-112945 2.1 LOW Vite: Cross origin script execution through Vite custom middleware

IV. Related Vulnerabilities

Same product: vite
Same vendor: vitejs
Same weakness: CWE-22

V. Comments for CVE-2026-112947

No comments yet

Leave a comment