Vite mocker path traversal allowing arbitrary file read (CVE-2026-04373)

Vulnerability Summary: Path Traversal / Arbitrary File Read via @vitejs/mocker Redirect Mock Vulnerability Overview Vulnerability Type: Path Traversal / Arbitrary File Read Vulnerability ID: CVE-2026-04373 Severity: Medium (CVSS 5.9 / 10) Vulnerability Description: The mock in does not validate the target path upon registration. An attacker can register a mock pointing outside the project root directory, causing the hook to return , enabling the reading of files outside the project root. This vulnerability can be exploited without authentication (via the public / interface). Scope of Impact Affected Packages: - : - : Fixed Versions: - : - : Impact: Allows reading local files accessible by the development server process (e.g., , , etc., in the root directory). There is no impact on integrity or availability. Preconditions: - The development server is bound to and is not accessible from external networks by default - Non-browser clients can register mocks through the unauthenticated HMR socket - Browser-side attacks require bypassing CORS restrictions (which by default limit sources to only) Key Code (POC / Exploitation Code) 1. File Read Sink (load hook) 2. Lack of Boundary Validation During Registration > There are no / checks upon registration, and there is no assertion that the resolved path lies within the project root directory. 3. Path Handling Logic Specialized protocols ( , ) are not normalized by WHATWG URL; segments are preserved, potentially resulting in a path outside the root directory Non-specialized protocols preserve in the ; resolves outside the root directory and allows reading arbitrary files Even if the path does not escape the root directory, the missing check allows reading any file accessible by the development server process (e.g., or in the root directory) Fix Solution Core Fix: When registering a mock, validate whether the resolved target path is within Vite's file serving allow-list ( ); if it is not in the allow-list, reject the registration of the mock. Specific Implementation: - In the registration flow of / , perform an check on the target path - If the path is not within the scope, reject the registration and throw an error - For the browser side, ensure that CORS policies restrict cross-origin access to prevent non-browser clients from bypassing restrictions Fixed Versions for Affected Releases: - fixed version: - fixed version: - Older versions (2.1.x, 3.x) are no longer maintained and will not receive backported fixes

Goal Reached Thanks to every supporter — we hit 100%!

Vite mocker path traversal allowing arbitrary file read (CVE-2026-04373)

More from this source