Vite: Cross origin script execution through Vite custom middleware

Summary When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server. Impact Only apps that match the following conditions are affected: - the dev server passes an unchanged browser request URL to...

npm: Vite: Cross origin script execution through Vite custom middleware

npm: Vite: Cross origin script execution through Vite custom middleware vulnerability discovered by ? in WordPress npm vite-plus versions = 1.0.0...

npm: Vite: Cross origin script execution through Vite custom middleware

npm: Vite: Cross origin script execution through Vite custom middleware vulnerability discovered by ? in WordPress npm vite versions = 6.4.3...

EUVD-2026-105128

Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machine...

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

Summary The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root. For example, if the project references /etc/hosts, the content of /etc/hosts was possible to be returned. The content of files outside the...

GHSA-RQ7H-C2JC-7F22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

Summary The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root. For example, if the project references /etc/hosts, the content of /etc/hosts was possible to be returned. The content of files outside the...

npm: Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

npm: Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machine vulnerability discovered by ? in WordPress npm vite versions = 6.4.3...

npm: Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

npm: Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machine vulnerability discovered by ? in WordPress npm vite-plus versions = 1.0.0...

Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

Summary The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Impact Only apps that match one of the following conditions are affected: - explicitly expose the Vite dev server to the network using --host or the...

EUVD-2026-105135

Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance...

GHSA-VFPM-58RQ-9QCG Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

Summary The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Impact Only apps that match one of the following conditions are affected: - explicitly expose the Vite dev server to the network using --host or the...

npm: Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

npm: Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance vulnerability discovered by ? in WordPress npm vite versions = 8.2.0, = 8.2.3...

npm: Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

npm: Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance vulnerability discovered by ? in WordPress npm vite-plus versions = 0.2.8, = 1.0.0...

CVE-2026-114063

SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...

CVE-2026-114063 SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows

SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...

CVE-2026-114063 SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows

SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...

CVE-2026-114063

SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...

EUVD-2026-107014

SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...

CVE-2026-114063

SvelteKit (@sveltejs/kit) versions 2.10.0 before 3.0.0 are vulnerable to a path traversal vulnerability within the vite preview server on Windows systems. This flaw allows unauthenticated attackers with network access or a tunnel to the preview server to send crafted requests and read files outsi...

PT-2026-120189

SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...