CVE-2026-53571: Vite Windows Path Traversal Exposes .env and Certificates

Technical summary

CVE-2026-53571 is a path traversal/information disclosure vulnerability in Vite's development server that affects Windows platforms. Vite implements a server.fs.deny configuration to restrict access to sensitive files (.env, .env.*, certificate files), but the access control logic fails to normalize NTFS Alternate Data Streams (ADS) paths and DOS 8.3 short filename aliases before evaluation. On Windows, requests like /.env::$DATA?raw are canonicalized by the OS to the underlying file's default data stream, bypassing Vite's deny checks. Similarly, DOS short name aliases (e.g., PROGRA~1) allow circumvention. The flaw affects the information disclosure channel only (CWE-200, CWE-22); no authentication is required and network access is sufficient for exploitation.

Business impact

Development teams using Vite on Windows are at direct risk of exposing sensitive configuration data, database credentials, API keys, and private key material through the public dev server. In shared or open environments—common in collaborative development setups—this can lead to credential compromise, lateral movement into backend systems, or certificate theft. If source control or artifact repositories are later accessed, leaked secrets enable further supply chain attacks. Organizations relying on Vite for internal or client-facing tooling should treat this as urgent.

Affected systems

Vite versions prior to 8.0.16, 7.3.5, and 6.4.3 are affected on Windows. The vulnerability does not apply to non-Windows platforms (Linux, macOS) because those OSes do not process NTFS ADS or 8.3 short names the same way. Windows developers and CI/CD pipelines running Vite on Windows are the primary targets. Related tooling like vite+ and Windows itself are listed in the advisory but the core vulnerability is in Vite's path normalization logic.

Exploitability

Exploitation is straightforward and requires no authentication. An attacker needs only network access to the Vite dev server (default port 5173, but configurable) and knowledge of standard sensitive filenames. Crafting a request with NTFS ADS syntax (e.g., /.env::$DATA) or attempting DOS short name variants is trivial and can be automated. The CVSS score of 7.5 (High) reflects high confidentiality impact, low attack complexity, no authentication, and network-adjacent attack surface. This is not listed on the CISA Known Exploited Vulnerabilities catalog, but the low barrier to weaponization means exploitation is likely if dev servers are internet-facing or accessible to untrusted network segments.

Remediation

Immediate action: upgrade Vite to version 8.0.16 (if on v8), 7.3.5 (if on v7), or 6.4.3 (if on v6) or later. These releases fix the Windows path normalization logic. For teams unable to patch immediately, restrict network access to the dev server to localhost or a trusted internal subnet only; do not expose Vite dev servers to the public internet or untrusted networks. Audit any Vite dev server logs for suspicious requests (those containing ::$DATA or unusual path patterns) and rotate any secrets that may have been exposed during the window of vulnerability.

Patch guidance

Vite uses npm/yarn/pnpm for distribution. Patch by updating your package.json to the fixed versions (8.0.16, 7.3.5, 6.4.3 or later depending on your current major/minor line) and running npm install / yarn install / pnpm install. Verify the update with npm list vite or equivalent. No manual configuration changes are required; the fix is automatic in the patched code. Test your build pipeline after patching to ensure no regressions. For monorepo environments, ensure all workspace packages that depend on Vite are updated uniformly.

Detection guidance

Monitor Vite dev server HTTP access logs for requests containing unusual path syntax: look for ::$DATA, ::$INDEX_ALLOCATION, or other NTFS ADS patterns; also flag requests using suspicious DOS-style shortnames (e.g., paths with tildes like PROGRA~1). Requests to /.env, /.env.*, or certificate paths (.crt, .pem) that succeed (non-404 responses) before and after this publication date warrant investigation. If you have internet-facing dev servers, assume compromise and rotate all secrets immediately. Static analysis tools should flag Vite configurations with overly permissive server.fs.deny settings or no deny list at all.

Why prioritize this

This should be prioritized as URGENT for Windows-based development teams. The barrier to exploitation is minimal, the exposed data is typically high-value (credentials, keys, configuration), and no exploit kit is needed. While not yet on CISA's Known Exploited list, the simplicity of the attack and relevance to developers make proactive patching critical. Organizations with internet-connected dev infrastructure or shared networks should treat this as a business continuity risk.

Risk score, explained

CVSS 7.5 (High) is justified by: network accessibility (AV:N), low attack complexity (AC:L), no authentication required (PR:N), no user interaction (UI:N), high confidentiality impact (C:H), no integrity or availability impact (I:N, A:N). The score reflects that an unauthenticated attacker can trivially extract secrets but cannot modify code or crash the server. In practice, the business risk may be higher if the exposed secrets unlock downstream systems; prioritize based on what credentials are visible in .env files and certificate stores on affected machines.

Frequently asked questions