{"schemaVersion":3,"id":"CVE-2026-112947","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal Wasm plugin's load hook. The hook removes the query and reads the resulting path directly from disk, but the server.fs checks were not applied. After reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file. This vulnerability is fixed in 8.2.4 and 8.3.3.","dates":{"published":"2026-10-20T15:10:51.025Z","modified":"2026-10-20T15:10:51.025Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.3,"severity":"medium","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/200.html"},{"id":"CWE-209","name":"Generation of Error Message Containing Sensitive Information","description":"The product generates an error message that includes sensitive information about its environment, users, or associated data.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/209.html"}],"affected":[{"vendor":"vitejs","product":"vite","name":"vite","label":"vite","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 8.3.0, < 8.3.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.2.0, < 8.2.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 8.3.0, < 8.3.3 | ≥ 8.2.0, < 8.2.4","eol":null,"hubHref":"/vendor/vitejs/vite"},{"vendor":"vitejs","product":"vite-plus","name":"vite-plus","label":"vite-plus","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 0.2.8, < 1.1.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.2.8, < 1.1.0","eol":null,"hubHref":"/vendor/vitejs/vite-plus"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-vfpm-58rq-9qcg","label":"github.com/vitejs/vite/security/advisories/GHSA-vfpm-58rq-9qcg","hostname":"github.com","tags":["X Refsource CONFIRM"]},{"url":"https://github.com/vitejs/vite/pull/23655","label":"github.com/vitejs/vite/pull/23655","hostname":"github.com","tags":["X Refsource MISC"]},{"url":"https://github.com/vitejs/vite/commit/b6c6d2fb3f853aab4092dc25f0d6816a96c23dff","label":"github.com/vitejs/vite/commit/b6c6d2fb3f853aab4092dc25f0d6816a96c23dff","hostname":"github.com","tags":["X Refsource MISC"]},{"url":"https://github.com/vitejs/vite/commit/ba8b7ab43b4afa5d0292ab4b6e3a7b5033cc9c73","label":"github.com/vitejs/vite/commit/ba8b7ab43b4afa5d0292ab4b6e3a7b5033cc9c73","hostname":"github.com","tags":["X Refsource MISC"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-20T15:10:51.025Z","label":"Published","detail":"Vulnerability first disclosed.","source":null}],"risk":{"score":25,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T19:37:33.304Z","stale":false,"partial":false}}