Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them. This vulnerability is fixed in 8.0.16, 7.3.5, and 6.4.3.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 3 products
| Date | Total | Labels |
|---|
| 2026-06-26 | 1 | Patch1 |
| 2026-06-30 | 1 | Disclosure1 |
CVE-2026-53571 - GitHub Advisory Database | vite: `server.fs.deny` bypass on Windows alternate paths | https://github.com/advisories/GHSA-fx2h-pf6j-xcff
Post summary
The GitHub Advisory for CVE‑2026‑53571 documents a `server.fs.deny` bypass on Windows alternate paths in Vite, providing a technical overview but no patch or active exploitation details.
🚨 CRITICAL: CVE-2026-53571 — Vite Path Traversal on Windows CVSS 8.2. NTFS ADS bypass allows attackers to read .env files via /.env::$DATA?raw. Affects Vite ≤ 8.0.15 / 7.3.4 / 6.4.2. Patch to 8.0.16 / 7.3.5 / 6.4.3. 🔗 https://threataft.com/articles/cve-2026-53571-vite-path-traversal-windows-env-exposure #CyberSecurity #vitejs
Post summary
The post announces CVE-2026-53571, a path traversal flaw in Vite on Windows, provides patch information, and technical details of the vulnerability, but does not present a PoC, exploit code, or evidence of active exploitation.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | microsoft | windows | - | - | - |
| App | vitejs | vite | - | node.js | - |
| App | voidzero | vite\+ | - | node.js | - |