CVE-2026-112945: Vite path traversal in transformIndexHtml

CVE-2026-112945 · Severity: medium · CVSS 4 · Published 2026-10-20

Vite is a JavaScript development framework that processes HTML files during development. Applications using custom middleware that pass unmodified browser request URLs to Vite's transformIndexHtml function are vulnerable to malicious code injection. An attacker can craft a URL that causes Vite to generate HTML with a malicious script module reference that the victim's browser will fetch and execute, potentially exposing sensitive data or allowing unauthorized actions within the application.

Technologies: vite-plus (npm), Vite, Vite. Vendors: npm, Vite.

Quick answers

Is CVE-2026-112945 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-112945 being exploited in the wild.
How severe is CVE-2026-112945?
Medium severity, with a CVSS score of 4, published 20 October 2026.
Which products and versions are affected?
vite-plus (npm) <= 1.0.0, SEMVER:introduced=0,fixed=1.1.0; Vite prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3; Vite >= 8.3.0, <= 8.3.2, SEMVER:introduced=8.3.0,fixed=8.3.3.
Is there a fix for CVE-2026-112945?
Yes. vite-plus (npm): upgrade to 1.1.0 or later; Vite: upgrade to 8.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112945 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-112945?
Check whether you run vite-plus (npm), Vite or Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • vite-plus (npm): upgrade to 1.1.0 or later
    npm install vite-plus@1.1.0
  • Vite: upgrade to 8.3.3 or later

Technical details

The vulnerability exists in getHtmlFilename, which resolves file paths using query-bearing request URLs while preserving attacker-supplied leading slashes in the generated proxy module URL. If transformed HTML contains an inline module script with a double-slash URL prefix, browsers interpret it as a protocol-relative URL and fetch the resource from an attacker-controlled domain. The attack requires a victim to load the crafted development-server page in a browser, but does not require authentication or additional user interaction.

Affected products

  • Vite Vite prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3

Identifiers

  • CVE-2026-112945
  • GHSA-9jrq-w75r-8gcw

Timeline

  • 2026-10-20: disclosed: Public disclosure via NVD
  • 2026-10-06: patched: Fix merged in GitHub PR #23653

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.