Vulnerabilities

TI-2026-82203 CVE-2026-118662 · GHSA-8g5g-mxqh-grgj

Vite server.fs.deny bypassed with loader query parameters

LOW 36

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00295 Published 2026-10-28 Fixed in 6.4.5 CWE-180

TI-2026-76915 CVE-2026-112948 · GHSA-p458-7748-mcp3

Vitest servers misapply server.fs.deny, exposing sensitive files

LOW 29

Vitest is a testing framework powered by Vite.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.004 Published 2026-10-20 Partial fix · 5.0.5, 1.3.0 CWE-200

TI-2026-76914 CVE-2026-112947 · GHSA-vfpm-58rq-9qcg

Vite leaks first 4 bytes of files outside server.fs via query

LOW 29

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00502 Published 2026-10-20 Partial fix · 8.3.3, 8.2.4 +1 CWE-200

TI-2026-76913 CVE-2026-112946 · GHSA-rq7h-c2jc-7f22

Vite serves files outside server.fs.allow on non-Windows hosts

MEDIUM 61

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00852 Published 2026-10-20 Partial fix · 8.3.3, 8.2.4 +4 CWE-22

TI-2026-76912 CVE-2026-112945 · GHSA-9jrq-w75r-8gcw

Cross-origin script execution in Vite custom middleware

MEDIUM 44

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00672 Published 2026-10-20 Partial fix · 8.3.3, 8.2.4 +4 CWE-80

TI-2026-76866 CVE-2026-112944 · GHSA-r825-w8mm-5pxw

Argument injection in launch-editor allows editor command execution

LOW 29

launch-editor allows users to open files with line numbers in editor from Node.js.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00705 Published 2026-10-20 Fixed in 2.14.2, 8.3.3 +5 CWE-88

TI-2026-76865 CVE-2026-112943 · GHSA-698v-4r3x-3vcv

Improper % escaping in launch-editor escapeCmdArgs() on Windows

LOW 28

launch-editor allows users to open files with line numbers in editor from Node.js.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00414 Published 2026-10-20 Fixed in 2.14.2, 8.3.3 +5 CWE-78

TI-2026-76864 CVE-2026-112942 · GHSA-587h-7wmj-h5pm

Existence check bypass in launch-editor can lead to command injection

LOW 38

launch-editor allows users to open files with line numbers in editor from Node.js.

CVSS 4.0HIGH 7.5 Network No auth User interaction EPSS 0.01344 Published 2026-10-20 Fixed in 2.14.2, 8.3.3 +5 CWE-77

TI-2026-38634 CVE-2026-53571 · GHSA-fx2h-pf6j-xcff

Vite: `server.fs.deny` bypass on Windows alternate paths

HIGH 69

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00577 Published 2026-06-22 Fixed in 8.0.16, 7.3.5 +2 CWE-200

TI-2026-38676 CVE-2026-53632 · GHSA-v6wh-96g9-6wx3

NTLMv2 hash disclosure via UNC path handling on Windows

MEDIUM 58

launch-editor allows users to open files with line numbers in editor from Node.js.

CVSS 4.0MEDIUM 5.5 Network No auth User interaction EPSS 0.00408 Published 2026-06-22 Partial fix · 2.14.1, 8.0.16 +3 CWE-522

TI-2024-34898 CVE-2024-52011 · GHSA-c27g-q93r-2cwf

launch-editor vulnerable to command injection via the crafted request on Windows

MEDIUM 41

launch-editor allows users to open files with line numbers in editor from Node.js.

CVSS 4.0HIGH 7.5 Network No auth User interaction EPSS 0.00514 Published 2026-06-01 Fixed in 2.9.0, 5.4.9 CWE-77

TI-2026-28352 CVE-2026-39365 · GHSA-4w7w-66w2-5vf9

Vite has a Path Traversal in Optimized Deps `.map` Handling

HIGH 69

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00914 Published 2026-04-07 Partial fix · 8.0.5, 7.3.2 +2 CWE-22

TI-2026-28351 CVE-2026-39364 · GHSA-v2wj-q39q-566r

Vite has a `server.fs.deny` bypass with queries

HIGH 69

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.02259 Published 2026-04-07 Partial fix · 8.0.5, 7.3.2 +1 CWE-180

TI-2026-28350 CVE-2026-39363 · GHSA-p9ff-h696-f583

Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

HIGH 75

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.03396 Published 2026-04-07 Partial fix · 8.0.5, 7.3.2 +2 CWE-200

TI-2025-41735 CVE-2025-68155 · GHSA-g239-q96q-x4qm

@vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development

HIGH 72

@vitejs/plugin-rs provides React Server Components (RSC) support for Vite.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00502 Published 2025-12-16 Fixed in 0.5.8 CWE-22

TI-2025-41248 CVE-2025-67489 · GHSA-j76j-5p5g-9wfr

Code injection in vitejs vite-plugin-react

HIGH 82

@vitejs/plugin-rs provides React Server Components (RSC) support for Vite.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00807 Published 2025-12-09 Fixed in 0.5.6 CWE-94

TI-2025-38762 CVE-2025-62522 · GHSA-93m4-6634-74q7

vite allows server.fs.deny bypass via backslash on Windows

MEDIUM 60

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.01054 Published 2025-10-20 Fixed in 7.1.11, 7.0.8 +5 CWE-22

TI-2025-36410 CVE-2025-58752 · GHSA-jqfw-vq24-v9c3

Vite's `server.fs` settings were not applied to HTML files

MEDIUM 45

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00608 Published 2025-09-08 Partial fix · 5.4.20, 6.3.6 +2 CWE-200

TI-2025-36409 CVE-2025-58751 · GHSA-g4jq-h2w9-997c

Vite middleware may serve files starting with the same name with the public directory

MEDIUM 45

Vite is a frontend tooling framework for JavaScript.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.01214 Published 2025-09-08 Partial fix · 5.4.20, 6.3.6 +2 CWE-200

TI-2025-29278 CVE-2025-46565 · GHSA-859w-5945-r5v3

Vite's server.fs.deny bypassed with /. for files under project root

MEDIUM 60

Vite is a frontend tooling framework for javascript.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.01243 Published 2025-05-01 Partial fix · 6.3.4, 6.2.7 +3 CWE-22

TI-2025-23473 CVE-2025-32395 · GHSA-356w-63v5-8wf4

Vite has an `server.fs.deny` bypass with an invalid `request-target`

MEDIUM 60

Vite is a frontend tooling framework for javascript.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.0181 Published 2025-04-10 Partial fix · 6.2.6, 6.1.5 +3 CWE-200

TI-2025-22667 CVE-2025-31486 · GHSA-xcj6-pq6g-qj4x

Vite allows server.fs.deny to be bypassed with .svg or relative paths

MEDIUM 57

Vite is a frontend tooling framework for javascript.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.40461 Published 2025-04-03 Partial fix · 4.5.12, 5.4.17 +3 CWE-200

TI-2025-22386 CVE-2025-31125 · GHSA-4r4m-qw57-chr8

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

CRITICAL 92KEV

Vite is a frontend tooling framework for javascript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.74939 Published 2025-03-31 Partial fix · 6.2.4, 6.1.3 +3 CWE-200

TI-2025-21544 CVE-2025-30208 · GHSA-x574-m823-4x7w

Vite bypasses server.fs.deny when using `?raw??`

HIGH 72

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.74771 Published 2025-03-24 Partial fix · 4.5.10, 5.4.15 +3 CWE-200

TI-2025-17777 CVE-2025-24010 · GHSA-vg6x-rcgg-rjx6

Vite allows any websites to send any requests to the development server and read the response

MEDIUM 62

Vite is a frontend tooling framework for javascript.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00297 Published 2025-01-20 Fixed in 6.0.9, 5.4.12 +1 CWE-1385

Vulnerabilities

Filters