ETK-2026-4022Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-4022",
  "cve_id": null,
  "display_id": "ETK-2026-4022",
  "ghsa_id": "GHSA-p4f5-76q4-ffq7",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Code injection in Vite development server virtual modules",
  "summary": "Vite development servers that are explicitly exposed to the network can be affected by injection through URL-derived virtual module identifiers. A remote attacker may read files outside the intended server file allow list and may cause code to run in the development server process. Instances bound only to local interfaces are not within the stated affected condition.",
  "mitigation": "Upgrade vite to 8.3.7, 8.2.5, 8.1.7, 7.3.8, or 6.4.6, as appropriate, and upgrade vite-plus to 1.5.1 where used. Until upgraded, do not expose the Vite development server to untrusted networks; bind it to a local interface or restrict network access.",
  "vendor": "npm",
  "product": "npm:vite",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">=8.3.0, <=8.3.6"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "8.3.7"
      ],
      "package_name": "vite",
      "purl": "pkg:npm/vite"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">=8.2.0, <=8.2.4"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "8.2.5"
      ],
      "package_name": "vite",
      "purl": "pkg:npm/vite"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">=8.0.0, <=8.1.6"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "8.1.7"
      ],
      "package_name": "vite",
      "purl": "pkg:npm/vite"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">=7.0.0, <=7.3.7"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "7.3.8"
      ],
      "package_name": "vite",
      "purl": "pkg:npm/vite"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.0.0, <=6.4.5"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "6.4.6"
      ],
      "package_name": "vite",
      "purl": "pkg:npm/vite"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "<=1.5.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.5.1"
      ],
      "package_name": "vite-plus",
      "purl": "pkg:npm/vite-plus"
    }
  ],
  "cwes": [
    116
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.995852533333334,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-11-10T01:35:55+00:00",
      "days": -1.0017643982407407,
      "is_lower_bound": true,
      "measured_at": "2026-11-11T01:38:27.484795+00:00",
      "url": "https://github.com/vitejs/vite/security/advisories/GHSA-p4f5-76q4-ffq7"
    },
    "trigger_signal": {
      "at": "2026-11-10T01:35:55+00:00",
      "days": -1.0017643982407407,
      "is_lower_bound": true,
      "measured_at": "2026-11-11T01:38:27.484795+00:00",
      "url": "https://github.com/vitejs/vite/security/advisories/GHSA-p4f5-76q4-ffq7"
    }
  }
}