vitejs

Records32All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high10CVSS 7.0–8.9

Exploited now

vitejs records in CISA KEV

TI-2025-22386 Vite Vitejs Improper Access Control Vulnerability CRITICAL 92KEV 2026-01-22

Components

Products in the NVD configurations · select one to filter the records

Vite 14 records CRITICAL

Records

32 records

TI-2025-22386 CVE-2025-31125 · GHSA-4r4m-qw57-chr8

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

CRITICAL 92KEV

Vite is a frontend tooling framework for javascript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.74939 Published 2025-03-31 Partial fix · 6.2.4, 6.1.3 +3 CWE-200

TI-2025-41248 CVE-2025-67489 · GHSA-j76j-5p5g-9wfr

Code injection in vitejs vite-plugin-react

HIGH 82

@vitejs/plugin-rs provides React Server Components (RSC) support for Vite.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00807 Published 2025-12-09 Fixed in 0.5.6 CWE-94

TI-2026-28350 CVE-2026-39363 · GHSA-p9ff-h696-f583

Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

HIGH 75

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.03396 Published 2026-04-07 Partial fix · 8.0.5, 7.3.2 +2 CWE-200

TI-2025-41735 CVE-2025-68155 · GHSA-g239-q96q-x4qm

@vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development

HIGH 72

@vitejs/plugin-rs provides React Server Components (RSC) support for Vite.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00502 Published 2025-12-16 Fixed in 0.5.8 CWE-22

TI-2025-21544 CVE-2025-30208 · GHSA-x574-m823-4x7w

Vite bypasses server.fs.deny when using `?raw??`

HIGH 72

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.74771 Published 2025-03-24 Partial fix · 4.5.10, 5.4.15 +3 CWE-200

TI-2023-16938 CVE-2023-34092 · GHSA-353f-5xf4-qw67

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

HIGH 72

Vite provides frontend tooling.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03152 Published 2023-06-01 Fixed in 2.9.16, 3.2.7 +4 CWE-200

TI-2026-38634 CVE-2026-53571 · GHSA-fx2h-pf6j-xcff

Vite: `server.fs.deny` bypass on Windows alternate paths

HIGH 69

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00577 Published 2026-06-22 Fixed in 8.0.16, 7.3.5 +2 CWE-200

TI-2026-28352 CVE-2026-39365 · GHSA-4w7w-66w2-5vf9

Vite has a Path Traversal in Optimized Deps `.map` Handling

HIGH 69

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00914 Published 2026-04-07 Partial fix · 8.0.5, 7.3.2 +2 CWE-22

TI-2026-28351 CVE-2026-39364 · GHSA-v2wj-q39q-566r

Vite has a `server.fs.deny` bypass with queries

HIGH 69

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.02259 Published 2026-04-07 Partial fix · 8.0.5, 7.3.2 +1 CWE-180

TI-2024-15433 CVE-2024-23331 · GHSA-c24v-8rfc-w8vw

Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

HIGH 66

Vite is a frontend tooling framework for javascript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00785 Published 2024-01-19 Fixed in 2.9.17, 3.2.8 +2 CWE-178

TI-2025-17777 CVE-2025-24010 · GHSA-vg6x-rcgg-rjx6

Vite allows any websites to send any requests to the development server and read the response

MEDIUM 62

Vite is a frontend tooling framework for javascript.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00297 Published 2025-01-20 Fixed in 6.0.9, 5.4.12 +1 CWE-1385

TI-2024-30778 CVE-2024-45812 · GHSA-64vr-g452-qvp3

DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite

MEDIUM 62

Vite a frontend build tooling framework for javascript.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00636 Published 2024-09-17 Partial fix · 5.4.6, 5.3.6 +5 CWE-79

TI-2026-76913 CVE-2026-112946 · GHSA-rq7h-c2jc-7f22

Vite serves files outside server.fs.allow on non-Windows hosts

MEDIUM 61

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00852 Published 2026-10-20 Partial fix · 8.3.3, 8.2.4 +4 CWE-22

TI-2025-38762 CVE-2025-62522 · GHSA-93m4-6634-74q7

vite allows server.fs.deny bypass via backslash on Windows

MEDIUM 60

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.01054 Published 2025-10-20 Fixed in 7.1.11, 7.0.8 +5 CWE-22

TI-2025-29278 CVE-2025-46565 · GHSA-859w-5945-r5v3

Vite's server.fs.deny bypassed with /. for files under project root

MEDIUM 60

Vite is a frontend tooling framework for javascript.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.01243 Published 2025-05-01 Partial fix · 6.3.4, 6.2.7 +3 CWE-22

TI-2025-23473 CVE-2025-32395 · GHSA-356w-63v5-8wf4

Vite has an `server.fs.deny` bypass with an invalid `request-target`

MEDIUM 60

Vite is a frontend tooling framework for javascript.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.0181 Published 2025-04-10 Partial fix · 6.2.6, 6.1.5 +3 CWE-200

TI-2026-38676 CVE-2026-53632 · GHSA-v6wh-96g9-6wx3

NTLMv2 hash disclosure via UNC path handling on Windows

MEDIUM 58

launch-editor allows users to open files with line numbers in editor from Node.js.

CVSS 4.0MEDIUM 5.5 Network No auth User interaction EPSS 0.00408 Published 2026-06-22 Partial fix · 2.14.1, 8.0.16 +3 CWE-522

TI-2025-22667 CVE-2025-31486 · GHSA-xcj6-pq6g-qj4x

Vite allows server.fs.deny to be bypassed with .svg or relative paths

MEDIUM 57

Vite is a frontend tooling framework for javascript.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.40461 Published 2025-04-03 Partial fix · 4.5.12, 5.4.17 +3 CWE-200

TI-2024-30777 CVE-2024-45811 · GHSA-9cwx-2883-4wfx

server.fs.deny bypassed when using ?import&raw in vite

MEDIUM 55

Vite a frontend build tooling framework for javascript.

CVSS 3.1MEDIUM 4.8 Adjacent network No auth User interaction EPSS 0.01105 Published 2024-09-17 Partial fix · 5.4.6, 5.3.6 +5 CWE-200

TI-2025-36410 CVE-2025-58752 · GHSA-jqfw-vq24-v9c3

Vite's `server.fs` settings were not applied to HTML files

MEDIUM 45

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00608 Published 2025-09-08 Partial fix · 5.4.20, 6.3.6 +2 CWE-200

TI-2025-36409 CVE-2025-58751 · GHSA-g4jq-h2w9-997c

Vite middleware may serve files starting with the same name with the public directory

MEDIUM 45

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.01214 Published 2025-09-08 Partial fix · 5.4.20, 6.3.6 +2 CWE-200

TI-2026-76912 CVE-2026-112945 · GHSA-9jrq-w75r-8gcw

Cross-origin script execution in Vite custom middleware

MEDIUM 44

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00672 Published 2026-10-20 Partial fix · 8.3.3, 8.2.4 +4 CWE-80

TI-2024-34898 CVE-2024-52011 · GHSA-c27g-q93r-2cwf

launch-editor vulnerable to command injection via the crafted request on Windows

MEDIUM 41

launch-editor allows users to open files with line numbers in editor from Node.js.

CVSS 4.0HIGH 7.5 Network No auth User interaction EPSS 0.00514 Published 2026-06-01 Fixed in 2.9.0, 5.4.9 CWE-77

TI-2026-76864 CVE-2026-112942 · GHSA-587h-7wmj-h5pm

Existence check bypass in launch-editor can lead to command injection

LOW 38

launch-editor allows users to open files with line numbers in editor from Node.js.

CVSS 4.0HIGH 7.5 Network No auth User interaction EPSS 0.01344 Published 2026-10-20 Fixed in 2.14.2, 8.3.3 +5 CWE-77

TI-2026-82203 CVE-2026-118662 · GHSA-8g5g-mxqh-grgj

Vite server.fs.deny bypassed with loader query parameters

LOW 36

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00295 Published 2026-10-28 Fixed in 6.4.5 CWE-180

Open these records in search →

Critical	1
High	10
Medium	18
Low	3
No CVSS	0