Is CVE-2026-112946 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112946 being exploited in the wild.

How severe is CVE-2026-112946?

Medium severity, with a CVSS score of 4, published 20 October 2026.

Which products and versions are affected?

vite-plus (npm) = 8.3.0, <= 8.3.2, SEMVER:introduced=8.3.0,fixed=8.3.3.

How is CVE-2026-112946 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-112946?

Check whether you run vite-plus (npm), Vitejs Vite or Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112946: Vite import analysis filesystem disclosure

Q: Is there a fix for CVE-2026-112946?

Yes. vite-plus (npm): upgrade to 1.1.0 or later; Vite: upgrade to 8.3.3 or later. Until then: Configure server.fs.deny rules to block access to sensitive files outside the project root, or restrict network access to the development server to trusted hosts only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-112946 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-112946?

Check whether you run vite-plus (npm), Vitejs Vite or Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112946 · Severity: medium · CVSS 4 · Published 2026-10-20

Vite is a frontend build tool that processes JavaScript and other web assets during development. When running a development server accessible over a network on non-Windows systems, a flaw in how Vite tracks imported modules could allow an attacker to request and read files outside the project directory, provided the file path matches a URL pattern the application has already imported. This is limited by access controls but can still leak sensitive source files.

Technologies: vite-plus (npm), Vite. Vendors: npm, Vitejs.

Quick answers

Is CVE-2026-112946 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112946 being exploited in the wild.
How severe is CVE-2026-112946?: Medium severity, with a CVSS score of 4, published 20 October 2026.
Which products and versions are affected?: vite-plus (npm) <= 1.0.0, SEMVER:introduced=0,fixed=1.1.0; Vitejs Vite Before 6.4.4, 7.3.7, 8.1.6, 8.2.4, 8.3.3; Vite >= 8.3.0, <= 8.3.2, SEMVER:introduced=8.3.0,fixed=8.3.3.
Is there a fix for CVE-2026-112946?: Yes. vite-plus (npm): upgrade to 1.1.0 or later; Vite: upgrade to 8.3.3 or later. Until then: Configure server.fs.deny rules to block access to sensitive files outside the project root, or restrict network access to the development server to trusted hosts only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112946 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-112946?: Check whether you run vite-plus (npm), Vitejs Vite or Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

vite-plus (npm): upgrade to 1.1.0 or later
```
npm install vite-plus@1.1.0
```
Vite: upgrade to 8.3.3 or later

Configure server.fs.deny rules to block access to sensitive files outside the project root, or restrict network access to the development server to trusted hosts only.

Technical details

The vulnerability exists in Vite's import analysis module, which records browser URLs instead of cleaned resolved module identifiers in the safeModulePaths list. On network-accessible dev servers, an attacker can craft a request for a file whose URL matches an absolute host path that corresponds to a project import, bypassing access controls unless server.fs.deny blocks it. This does not enable arbitrary path traversal, only disclosure of files with matching URLs already authorized by the application graph.

Affected products

vitejs Vite Before 6.4.4, 7.3.7, 8.1.6, 8.2.4, 8.3.3

Identifiers

CVE-2026-112946
GHSA-rq7h-c2jc-7f22

Timeline

2026-10-06: patched: Fixes merged in commit 170b9279 and 45c0e339
2026-10-20: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.