Bug 2556242 (CVE-2026-112945)

Summary:	CVE-2026-112945 vite: vite: Arbitrary script execution via improper URL handling during HTML transformation
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, cdrage, csuconic, dbruscin, dlofthou, doconnor, drichtar, dschmidt, eborisov, gtully, istudens, ivassile, iweiss, jlanda, jsherman, jwong, kshier, kvanderr, lball, mosmerov, mposolda, msvehla, ngough, nwallace, omaciel, pberan, pesilva, pjindal, pmackay, rbobbitt, rgemmell, rgodfrey, rmartinc, rstancel, rushinde, sdawley, simaishi, ssilvert, stcannon, sthorger, tbish, thjenkin, tlavocat, vdosoudi, veshanka, vmuzikar, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Vite. An attacker can achieve arbitrary script execution in a user's browser by convincing a victim to load a crafted development server page when an application uses custom middleware. Due to improper handling of leading slashes in request URLs during HTML transformation, the browser can be tricked into fetching and executing an external, attacker-controlled module. This execution may result in sensitive information disclosure or allow unauthorized actions within the affected application.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2561770, 2561771, 2561772
Bug Blocks:

Description OSIDB Bzimport 2026-10-20 15:32:39 UTC

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in the Vite-served page. This execution can expose sensitive page data or permit critical actions available to the affected application. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.