{"schema":"threatline.record/2","record":{"id":"CVE-2026-53571","aliases":["GHSA-fx2h-pf6j-xcff"],"summary":"vite: `server.fs.deny` bypass on Windows alternate paths","details":"### Summary\n\nThe contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser on Windows.\n\n### Impact\n\nOnly apps that match the following conditions are affected:\n\n- explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host))\n- the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow)\n- either of:\n  - the sensitive file exists in an NTFS volume\n  - the dev server is running on Windows and the sensitive file exists in a volume that 8.3 short name generation is enabled (it is enabled by default on system volumes)\n\n### Details\n\nVite’s dev server denies direct access to sensitive files through `server.fs.deny`, including entries such as `.env`, `.env.*`, and `*.{crt,pem}`. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied.\nBecause of this, requests such as `/.env::$DATA?raw` are treated as allowed paths, while Windows resolves them to the original file's default data stream.\n\nSimilar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them.\n\n### PoC\n```bash\n$ npm create vite@latest\n$ cd vite-project/\n$ npm install\n$ npm run dev\n```\nAccess via browser at `http://localhost:5173/.env::$DATA?raw`\n<img width=\"388\" height=\"129\" alt=\"deecc1315123883cfd0f9c26a002845a\" src=\"https://github.com/user-attachments/assets/895c6012-4e2e-4a35-babb-69bbf3ee7170\" />\n\nExample expected result:\n- `/.env::$DATA?raw` returns the contents of `.env`\n- `/tls.pem::$DATA?raw` returns the contents of `tls.pem`","categories":["Libraries & packages"],"product":"vite","vendor":"vitejs","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","source_modified_at":"2026-10-27T14:58:31Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"npm","name":"vite"},"range":">= 8.0.0, <= 8.0.15"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","source_modified_at":"2026-10-27T14:58:31Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"npm","name":"vite"},"range":">= 7.0.0, <= 7.3.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","source_modified_at":"2026-10-27T14:58:31Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"npm","name":"vite"},"range":"<= 6.4.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","source_modified_at":"2026-10-27T14:58:31Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"npm","name":"vite-plus"},"range":"<= 0.1.23"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53571","source_modified_at":"2026-06-22T18:07:53.961Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"vite","vendor":"vitejs","versions":[{"version":">= 8.0.0, < 8.0.16","status":"affected"},{"version":">= 7.0.0, < 7.3.5","status":"affected"},{"version":"< 6.4.3","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff","source_modified_at":"2026-10-27T15:15:07.885624041Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"vite","ecosystem":"npm","purl":"pkg:npm/vite"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.16"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff","source_modified_at":"2026-10-27T15:15:07.885624041Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"vite","ecosystem":"npm","purl":"pkg:npm/vite"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.3.5"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff","source_modified_at":"2026-10-27T15:15:07.885624041Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"vite","ecosystem":"npm","purl":"pkg:npm/vite"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.4.3"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff","source_modified_at":"2026-10-27T15:15:07.885624041Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"vite-plus","ecosystem":"npm","purl":"pkg:npm/vite-plus"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.24"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","source_modified_at":"2026-10-27T14:58:31Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"npm","name":"vite"},"version":"8.0.16"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","source_modified_at":"2026-10-27T14:58:31Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"npm","name":"vite"},"version":"7.3.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","source_modified_at":"2026-10-27T14:58:31Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"npm","name":"vite"},"version":"6.4.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","source_modified_at":"2026-10-27T14:58:31Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"npm","name":"vite-plus"},"version":"0.1.24"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff","source_modified_at":"2026-10-27T15:15:07.885624041Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"vite","ecosystem":"npm","purl":"pkg:npm/vite"},"version":"8.0.16"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff","source_modified_at":"2026-10-27T15:15:07.885624041Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"vite","ecosystem":"npm","purl":"pkg:npm/vite"},"version":"7.3.5"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff","source_modified_at":"2026-10-27T15:15:07.885624041Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"vite","ecosystem":"npm","purl":"pkg:npm/vite"},"version":"6.4.3"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff","source_modified_at":"2026-10-27T15:15:07.885624041Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"vite-plus","ecosystem":"npm","purl":"pkg:npm/vite-plus"},"version":"0.1.24"}],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00577,"percentile":0.47336,"score_date":"2026-10-27"},"published_at":"2026-06-22T16:10:58.500Z","modified_at":"2026-10-27T15:15:07.885624041Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T14:58:31Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-53571","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-06-22T18:07:53.961Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T15:15:07.885624041Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53571","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53571","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-06-22T18:07:16.554503Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-27T15:15:07.885624041Z","content_hash":"5f177576d722a165acbdce5ca1d7470fa205852aa6359c706caf50eedc8731e4"}}