CVE-2026-112945

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in the Vite-served page. This execution can expose sensitive page data or permit critical actions available to the affected application. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.

• CWE-80

• https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17
• https://github.com/vitejs/vite/pull/23653
• https://github.com/vitejs/vite/security/advisories/GHSA-9jrq-w75r-8gcw

Published

Oct 20, 2026

Last Modified

Oct 20, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11294Inappropriate implementation in Passwords in Google Chrome p…4.3
• CVE-2026-112940filelock is a platform-independent file lock for Python. Fro…7.1
• CVE-2026-112941filelock is a platform-independent file lock for Python. Fro…3.3
• CVE-2026-112942launch-editor allows users to open files with line numbers i…7.5
• CVE-2026-112943launch-editor allows users to open files with line numbers i…6.3
• CVE-2026-112944launch-editor allows users to open files with line numbers i…6.3
• CVE-2026-112946Vite is a frontend tooling framework for JavaScript. Prior t…6.3
• CVE-2026-112947Vite is a frontend tooling framework for JavaScript. From 8.…6.3
• CVE-2026-112948Vitest is a testing framework powered by Vite. From 5.0.0-be…6.5
• CVE-2026-112949Vitest is a Vite-native testing framework for JavaScript and…4.7
• CVE-2026-11295Inappropriate implementation in WebView in Google Chrome on …8.8
• CVE-2026-112950Vitest is a Vite-native testing framework for JavaScript and…5.9