Executive brief
Vite is a popular development tool used by programmers to build and test JavaScript applications. A security flaw in its development server allows unauthorized users to access sensitive files on Windows systems, such as environment variables, private keys, and configuration files. This could lead to the exposure of database passwords or security certificates if the development server is exposed to a network.
Technical details
A path traversal and information disclosure vulnerability exists in the Vite development server when running on Windows. The 'server.fs.deny' configuration, which is intended to block access to sensitive files like .env or .crt, fails to account for NTFS Alternate Data Streams (ADS) and 8.3 short file names. An attacker can bypass these checks by requesting files using suffixes like '::$DATA' or by using shortened Windows file aliases. This allows a remote attacker to read the contents of restricted files if the dev server is configured to listen on a network interface. The issue is fixed in versions 8.0.16, 7.3.5, and 6.4.3.
Affected products
- vitejs Vite >= 8.0.0, < 8.0.16; >= 7.0.0, < 7.3.5; < 6.4.3
- vitejs vite-plus <= 0.1.23
Timeline
- 2026-06-01: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD