[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vite (source)	6.4.4 → 6.4.5

---

Vite: server.fs.deny bypassed with queries

CVE-2026-118662 / GHSA-8g5g-mxqh-grgj

More information

Details

Summary

The contents of files that are specified by server.fs.deny can be returned to the browser. This is the same as GHSA-v2wj-q39q-566r.

Impact

Only apps that match the following conditions are affected:

• explicitly exposes the Vite dev server to the network (using --host or server.host config option)
• the sensitive file exists in the allowed directories specified by server.fs.allow
• the sensitive file is denied with a pattern that matches a file by server.fs.deny

Details

On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended.

For the fix for GHSA-rq7h-c2jc-7f22, v6.4.4 back-ported https://github.com/vitejs/vite/pull/20410. But while that PR requires https://github.com/vitejs/vite/pull/22160 for GHSA-v2wj-q39q-566r, https://github.com/vitejs/vite/pull/22160 wasn't back-ported together causing v6 vulnerable to GHSA-v2wj-q39q-566r.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N

References

• https://github.com/vitejs/vite/security/advisories/GHSA-8g5g-mxqh-grgj
• https://nvd.nist.gov/vuln/detail/CVE-2026-118662
• https://github.com/vitejs/vite/pull/22160
• https://github.com/vitejs/vite/pull/23855
• https://github.com/vitejs/vite/commit/91e40d7bf9777057bbd31c3eb036a54c9465697e
• https://github.com/vitejs/vite/releases/tag/v6.4.5
• https://github.com/advisories/GHSA-8g5g-mxqh-grgj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vitejs/vite (vite)

v6.4.5

Compare Source

Please refer to CHANGELOG.md for details.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[alwaysmeticulous]

✅ Meticulous spotted 0 visual differences across 14 screens tested: view results.

Meticulous evaluated ~4 hours of user flows against your PR.

_{Expected differences? Click here. Last updated for commit 38fdaba chore(deps): update dependency vite to v6.4.5 [security]. This comment will update as new commits are pushed.}