{"affected":[{"product":"vite","source":"CNA: GitHub_M","vendor":"vitejs","versions":[{"status":"affected","version":">= 6.4.4, < 6.4.5"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"vite","product":"vite","source":"OSV GHSA-8g5g-mxqh-grgj","vendor":"","versions":[{"status":"affected","version":"6.4.4","versionType":"npm"},{"events":[{"introduced":"6.4.4"},{"fixed":"6.4.5"}],"lessThan":"6.4.5","status":"affected","version":"6.4.4","versionType":"semver"}]}],"cveId":"CVE-2026-118662","cwes":["CWE-180","CWE-284"],"description":"Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.","epss":{"date":"2026-11-02","percentile":0.22137,"score":0.00295},"exploits":[],"kev":null,"metrics":[{"score":6.9,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793663825251,"publishedAt":1793219616440,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/vitejs/vite/security/advisories/GHSA-8g5g-mxqh-grgj"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/vitejs/vite/pull/22160"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/vitejs/vite/pull/23855"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/vitejs/vite/commit/91e40d7bf9777057bbd31c3eb036a54c9465697e"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/vitejs/vite/releases/tag/v6.4.5"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-8g5g-mxqh-grgj"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-8g5g-mxqh-grgj"}],"remediation":[{"kind":"fix","source":"OSV GHSA-8g5g-mxqh-grgj","text":"vite (npm): OSV reports a fixed version 6.4.5. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-8g5g-mxqh-grgj"}],"revision":"59c57a0b258a2cc2c7312cdeabddc0b2c5098b4235b910cc97e673d7c6f8f762","sources":[{"modifiedAt":1793663825251,"name":"CNA: GitHub_M","retrievedAt":1793668135755,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118662"},{"modifiedAt":1793292304362,"name":"OSV / GitHub Security Advisories","retrievedAt":1793668136463,"url":"https://osv.dev/vulnerability/GHSA-8g5g-mxqh-grgj"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793668153725,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118662"}],"ssvc":{"assessedAt":1793663811165,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Vite: `server.fs.deny` bypassed with queries","updatedAt":1793668153725}