TI-2026-38634 CVE-2026-53571 · GHSA-fx2h-pf6j-xcff
Vite: `server.fs.deny` bypass on Windows alternate paths
Priority HIGH 69
Vite is a frontend tooling framework for JavaScript.
Vulnerabilities
14 records
TI-2026-28352 CVE-2026-39365 · GHSA-4w7w-66w2-5vf9
Vite has a Path Traversal in Optimized Deps `.map` Handling
Priority HIGH 69
Vite is a frontend tooling framework for JavaScript.
TI-2026-28351 CVE-2026-39364 · GHSA-v2wj-q39q-566r
Vite has a `server.fs.deny` bypass with queries
Priority HIGH 69
Vite is a frontend tooling framework for JavaScript.
TI-2026-28350 CVE-2026-39363 · GHSA-p9ff-h696-f583
Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket
Priority HIGH 75
Vite is a frontend tooling framework for JavaScript.
TI-2025-36410 CVE-2025-58752 · GHSA-jqfw-vq24-v9c3
Vite's `server.fs` settings were not applied to HTML files
Priority MEDIUM 45
Vite is a frontend tooling framework for JavaScript.
TI-2025-36409 CVE-2025-58751 · GHSA-g4jq-h2w9-997c
Vite middleware may serve files starting with the same name with the public directory
Priority MEDIUM 45
Vite is a frontend tooling framework for JavaScript.
TI-2025-29278 CVE-2025-46565 · GHSA-859w-5945-r5v3
Vite's server.fs.deny bypassed with /. for files under project root
Priority MEDIUM 60
Vite is a frontend tooling framework for javascript.
TI-2025-22386 CVE-2025-31125 · GHSA-4r4m-qw57-chr8
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
Priority CRITICAL 92KEV
Vite is a frontend tooling framework for javascript.
TI-2025-21544 CVE-2025-30208 · GHSA-x574-m823-4x7w
Vite bypasses server.fs.deny when using `?raw??`
Priority HIGH 72
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10.
TI-2025-17777 CVE-2025-24010 · GHSA-vg6x-rcgg-rjx6
Vite allows any websites to send any requests to the development server and read the response
Priority MEDIUM 62
Vite is a frontend tooling framework for javascript.
TI-2024-15433 CVE-2024-23331 · GHSA-c24v-8rfc-w8vw
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Priority HIGH 66
Vite is a frontend tooling framework for javascript.
TI-2023-26929 CVE-2023-49293 · GHSA-92r3-m2mg-pj97
Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite
Priority LOW 29
Vite is a website frontend framework.
TI-2023-16938 CVE-2023-34092 · GHSA-353f-5xf4-qw67
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Priority HIGH 72
Vite provides frontend tooling.
TI-2022-15895 CVE-2022-35204 · GHSA-mv48-hcvh-8jj8
Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory…
Priority LOW 23
Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service.