{"schema":"threatline.record/2","record":{"id":"CVE-2026-118662","aliases":["GHSA-8g5g-mxqh-grgj"],"summary":"Vite: `server.fs.deny` bypassed with queries","details":"Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.","categories":["Unclassified"],"product":"vite","vendor":"vitejs","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118662","source_modified_at":"2026-10-28T20:33:36.440Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"vite","vendor":"vitejs","versions":[{"version":">= 6.4.4, < 6.4.5","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T20:33:36.440Z","modified_at":"2026-10-28T20:33:36.440Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-118662","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T20:33:36.440Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/vitejs/vite/security/advisories/GHSA-8g5g-mxqh-grgj","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/vitejs/vite/pull/22160","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/vitejs/vite/pull/23855","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/vitejs/vite/commit/91e40d7bf9777057bbd31c3eb036a54c9465697e","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/vitejs/vite/releases/tag/v6.4.5","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T20:33:36.440Z","content_hash":"87313e2a320847fb9dd0ee05ec4806e7ee9f752e56a07e8fe03b9003748d5c21"}}