Technical impact
Vite, a popular JavaScript front‑end build tool, contains a configuration bypass that allows an attacker to read files that should be blocked by server.fs.deny when the development server runs on Windows. The bug occurs because the server does not normalize NTFS alternate data stream and 8.3 short‑name path forms before applying the deny check. As a result, URLs such as /.env::$DATA?raw or references through 8.3 short names can return the contents of files like .env, .env.* or certificate files to the client. This leads to direct confidential data disclosure and corresponds to CWE‑200 (Information Exposure) and CWE‑22 (Path Traversal).
Affected Systems
Affected products are Vite by vitejs, versions earlier than 8.0.16, 7.3.5, and 6.4.3. Any installation running these legacy releases on a Windows operating system and exposing the dev server to a network is potentially vulnerable.
Risk and Exploitability
With a CVSS base score of 8.2, the disclosure is considered high severity. The vulnerability is exploit‑able through arbitrary HTTP requests to a Vite dev server that is accessible from the network. The risk is significant when the server is exposed outside trusted environments, though it does not allow code execution or privilege escalation. Since the EPSS score is not available and the issue is not listed in the CISA KEV catalog, the probability of widespread exploitation is unknown, but the lack of patching in legacy versions increases the likelihood for any exposed dev server. The most probable attack path involves a remote attacker sending a crafted request containing an NTFS ADS or 8.3 short name and receiving the file contents in the response.
Github GHSA