CVE-2026-118662

The Vite frontend tooling framework (versions 6.4.4 through 6.4.5 ) contains a vulnerability where the development server improperly evaluates server.fs.deny rules before stripping loader query parameters. An unauthenticated attacker can bypass these restrictions by appending queries like ?raw , ...