TI-2025-22386 CVE-2025-31125 · GHSA-4r4m-qw57-chr8
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
Priority CRITICAL 92KEV
Vite is a frontend tooling framework for javascript.
vitejs
Records32All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9
Exploited now
vitejs records in CISA KEVComponents
Products in the NVD configurations · select one to filter the recordsRecords
14 records in Vite · all components
TI-2026-28350 CVE-2026-39363 · GHSA-p9ff-h696-f583
Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket
Priority HIGH 75
Vite is a frontend tooling framework for JavaScript.
TI-2025-21544 CVE-2025-30208 · GHSA-x574-m823-4x7w
Vite bypasses server.fs.deny when using `?raw??`
Priority HIGH 72
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10.
TI-2023-16938 CVE-2023-34092 · GHSA-353f-5xf4-qw67
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Priority HIGH 72
Vite provides frontend tooling.
TI-2026-38634 CVE-2026-53571 · GHSA-fx2h-pf6j-xcff
Vite: `server.fs.deny` bypass on Windows alternate paths
Priority HIGH 69
Vite is a frontend tooling framework for JavaScript.
TI-2026-28352 CVE-2026-39365 · GHSA-4w7w-66w2-5vf9
Vite has a Path Traversal in Optimized Deps `.map` Handling
Priority HIGH 69
Vite is a frontend tooling framework for JavaScript.
TI-2026-28351 CVE-2026-39364 · GHSA-v2wj-q39q-566r
Vite has a `server.fs.deny` bypass with queries
Priority HIGH 69
Vite is a frontend tooling framework for JavaScript.
TI-2024-15433 CVE-2024-23331 · GHSA-c24v-8rfc-w8vw
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Priority HIGH 66
Vite is a frontend tooling framework for javascript.
TI-2025-17777 CVE-2025-24010 · GHSA-vg6x-rcgg-rjx6
Vite allows any websites to send any requests to the development server and read the response
Priority MEDIUM 62
Vite is a frontend tooling framework for javascript.
TI-2025-29278 CVE-2025-46565 · GHSA-859w-5945-r5v3
Vite's server.fs.deny bypassed with /. for files under project root
Priority MEDIUM 60
Vite is a frontend tooling framework for javascript.
TI-2025-36410 CVE-2025-58752 · GHSA-jqfw-vq24-v9c3
Vite's `server.fs` settings were not applied to HTML files
Priority MEDIUM 45
Vite is a frontend tooling framework for JavaScript.
TI-2025-36409 CVE-2025-58751 · GHSA-g4jq-h2w9-997c
Vite middleware may serve files starting with the same name with the public directory
Priority MEDIUM 45
Vite is a frontend tooling framework for JavaScript.
TI-2023-26929 CVE-2023-49293 · GHSA-92r3-m2mg-pj97
Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite
Priority LOW 29
Vite is a website frontend framework.
TI-2022-15895 CVE-2022-35204 · GHSA-mv48-hcvh-8jj8
Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory…
Priority LOW 23
Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service.