This CVE describes a flaw in Vite's custom middleware handling which allows an attacker to craft a URL that is passed unchanged to the server.transformIndexHtml function. The function then generates a proxy module URL that preserves leading slashes from the original request. If the transformed HTML contains an inline module script, the double slash causes the browser to fetch and execute a module from an attacker‑controlled location. This can lead to the execution of arbitrary code within the context of the served page, exposing sensitive data or enabling destructive actions. The weakness corresponds to CWE‑80, a type of cross‑site scripting vulnerability.

Vite and Vite‑Plus versions earlier than 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3 are affected. Vendors include vitejs for both Vite and Vite‑Plus. The vulnerability arises when applications use custom middleware without sanitizing request URLs.

The CVSS score is 2.1, indicating a low severity reference. EPSS data is not available, and the issue is not listed in CISA's KEV catalog. The vulnerability is exploitable by an attacker who can control the development‑server request, such as through a public dev server or by manipulating the request from a trusted user. The exploit requires the presence of an inline module script in the served HTML, but once triggered it results in the loading of a malicious module that executes in the victim's browser context.