{"kind": "product", "path": "vulns/npm/vite", "name": "vite", "product": "vite", "ecosystem": "npm", "items": [{"id": "CVE-2026-112947", "noindex": false, "published": "2026-10-20T15:10:51.025Z", "modified": "2026-10-21T15:54:49.530Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00422, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-112947", "title": "Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`", "description": "Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal Wasm plugin's load hook. The hook removes the query and reads the resulting path directly from disk, but the server.fs checks were not applied. After reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file. This vulnerability is fixed in 8.2.4 and 8.3.", "references": ["https://github.com/vitejs/vite/security/advisories/GHSA-vfpm-58rq-9qcg", "https://github.com/vitejs/vite/pull/23655", "https://github.com/vitejs/vite/commit/b6c6d2fb3f853aab4092dc25f0d6816a96c23dff"], "fixes": ["8.2.4", "8.3.3"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2026-112946", "noindex": false, "published": "2026-10-20T15:03:55.196Z", "modified": "2026-10-20T16:46:18.810Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00851, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-112946", "title": "Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine", "description": "Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by ", "references": ["https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22", "https://github.com/vitejs/vite/pull/23656", "https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa"], "fixes": ["6.4.4", "7.3.7", "8.1.6", "8.2.4", "8.3.3"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2026-112945", "noindex": false, "published": "2026-10-20T15:00:58.170Z", "modified": "2026-10-20T15:00:58.170Z", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00467, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-112945", "title": "Vite: Cross origin script execution through Vite custom middleware", "description": "Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in the Vite-served page. This execut", "references": ["https://github.com/vitejs/vite/security/advisories/GHSA-9jrq-w75r-8gcw", "https://github.com/vitejs/vite/pull/23653", "https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17"], "fixes": ["6.4.4", "7.3.7", "8.1.6", "8.2.4", "8.3.3"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2026-112944", "noindex": false, "published": "2026-10-20T14:57:38.728Z", "modified": "2026-10-20T15:23:12.248Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00705, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-112944", "title": "launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors", "description": "launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emac", "references": ["https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw", "https://github.com/vitejs/launch-editor/pull/156", "https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4"], "fixes": ["6.4.4", "7.3.7", "8.1.6", "8.2.4", "8.3.3"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2026-112943", "noindex": false, "published": "2026-10-20T14:53:41.777Z", "modified": "2026-10-20T15:13:40.862Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00414, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-112943", "title": "launch-editor: escapeCmdArgs() omits % escaping on Windows", "description": "launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.", "references": ["https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv", "https://github.com/vitejs/launch-editor/pull/155", "https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc"], "fixes": ["6.4.4", "7.3.7", "8.1.6", "8.2.4", "8.3.3"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2026-112942", "noindex": false, "published": "2026-10-20T14:48:06.676Z", "modified": "2026-10-21T15:55:05.963Z", "cvss": 7.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.01329, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-112942", "title": "launch-editor: `fs.existsSync()` existence check can be bypassed on Windows", "description": "launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with ", "references": ["https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm", "https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679", "https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"], "fixes": ["6.4.4", "7.3.7", "8.1.6", "8.2.4", "8.3.3"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2026-53571", "noindex": false, "published": "2026-06-22T16:10:58.500Z", "modified": "2026-06-22T18:07:53.961Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00577, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-53571", "title": "Vite: `server.fs.deny` bypass on Windows alternate paths", "description": "Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file ", "references": ["https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff", "https://nvd.nist.gov/vuln/detail/CVE-2026-53571"], "fixes": ["6.4.3", "7.3.5", "8.0.16"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2026-53632", "noindex": false, "published": "2026-06-22T15:54:09.240Z", "modified": "2026-06-22T17:30:11.939Z", "cvss": 5.5, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H", "severity": "medium", "epss": 0.00408, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-53632", "title": "NTLMv2 hash disclosure via UNC path handling on Windows", "description": "launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.", "references": ["https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3", "https://nvd.nist.gov/vuln/detail/CVE-2026-53632"], "fixes": ["6.4.3", "7.3.5", "8.0.16"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2024-52011", "noindex": false, "published": "2026-06-01T17:17:43.792Z", "modified": "2026-09-04T12:04:46.222Z", "cvss": 7.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00514, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2024-52011", "title": "launch-editor vulnerable to command injection via the crafted request on Windows", "description": "launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.", "references": ["https://github.com/vitejs/launch-editor/security/advisories/GHSA-c27g-q93r-2cwf", "https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e", "https://access.redhat.com/security/cve/CVE-2024-52011"], "fixes": ["5.4.9"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2026-39365", "noindex": false, "published": "2026-04-07T19:13:50.927Z", "modified": "2026-04-15T14:23:24.501Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00982, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-39365", "title": "Vite has a Path Traversal in Optimized Deps `.map` Handling", "description": "Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.", "references": ["https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9", "https://nvd.nist.gov/vuln/detail/CVE-2026-39365"], "fixes": ["6.4.2", "7.3.2", "8.0.5"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2026-39364", "noindex": false, "published": "2026-04-07T19:12:47.577Z", "modified": "2026-08-17T12:05:13.339Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.01535, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-39364", "title": "Vite has a `server.fs.deny` bypass with queries", "description": "Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.", "references": ["https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r", "https://access.redhat.com/security/cve/CVE-2026-39364", "https://bugzilla.redhat.com/show_bug.cgi?id=2456181"], "fixes": ["7.3.2", "8.0.5"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2026-39363", "noindex": false, "published": "2026-04-07T19:10:44.916Z", "modified": "2026-08-25T12:05:41.283Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.02619, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-39363", "title": "Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket", "description": "Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default \"...\"). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.", "references": ["https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583", "https://access.redhat.com/security/cve/CVE-2026-39363", "https://bugzilla.redhat.com/show_bug.cgi?id=2456179"], "fixes": ["6.4.2", "7.3.2", "8.0.5"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2025-62522", "noindex": false, "published": "2025-10-20T19:57:13.188Z", "modified": "2025-10-20T20:17:08.287Z", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.01054, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-62522", "title": "vite allows server.fs.deny bypass via backslash on Windows", "description": "Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \\ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.", "references": ["https://github.com/vitejs/vite/security/advisories/GHSA-93m4-6634-74q7", "https://github.com/vitejs/vite/commit/f479cc57c425ed41ceb434fecebd63931b1ed4ed", "https://nvd.nist.gov/vuln/detail/CVE-2025-62522"], "fixes": ["5.4.21", "6.4.1", "7.0.8", "7.1.11"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2025-58752", "noindex": false, "published": "2025-09-08T22:56:58.039Z", "modified": "2025-09-09T13:29:30.868Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00608, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-58752", "title": "Vite's `server.fs` settings were not applied to HTML files", "description": "Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: 'spa'` (default) or `appType: 'mpa'` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.", "references": ["https://github.com/vitejs/vite/security/advisories/GHSA-jqfw-vq24-v9c3", "https://github.com/vitejs/vite/commit/0ab19ea9fcb66f544328f442cf6e70f7c0528d5f", "https://github.com/vitejs/vite/commit/14015d794f69accba68798bd0e15135bc51c9c1e"], "fixes": ["5.4.20", "6.3.6", "7.0.7", "7.1.5"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2025-58751", "noindex": false, "published": "2025-09-08T22:52:45.667Z", "modified": "2025-09-09T13:29:36.802Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.01214, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-58751", "title": "Vite middleware may serve files starting with the same name with the public directory", "description": "Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.", "references": ["https://github.com/vitejs/vite/security/advisories/GHSA-g4jq-h2w9-997c", "https://github.com/lukeed/sirv/commit/f0113f3f8266328d804ee808f763a3c11f8997eb", "https://github.com/vitejs/vite/commit/09f2b52e8d5907f26602653caf41b3a56692600d"], "fixes": ["5.4.20", "6.3.6", "7.0.7", "7.1.5"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2025-46565", "noindex": false, "published": "2025-05-01T17:20:29.773Z", "modified": "2025-05-02T17:38:55.291Z", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.0117, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-46565", "title": "Vite's server.fs.deny bypassed with /. for files under project root", "description": "Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. `server.fs.deny` can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under `root` by using a c", "references": ["https://github.com/vitejs/vite/security/advisories/GHSA-859w-5945-r5v3", "https://github.com/vitejs/vite/commit/c22c43de612eebb6c182dd67850c24e4fab8cacb", "https://nvd.nist.gov/vuln/detail/CVE-2025-46565"], "fixes": ["4.5.14", "5.4.19", "6.1.6", "6.2.7", "6.3.4"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2025-32395", "noindex": false, "published": "2025-04-10T13:25:19.177Z", "modified": "2025-04-10T14:14:40.591Z", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.01775, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-32395", "title": "Vite has an `server.fs.deny` bypass with an invalid `request-target`", "description": "Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec (RFC 9112) does not allow # in request-target. Although an attacker can send such a request. For those requests with an invalid request-line (it includes request-target), the spec recommends to reject them with 400 or 301. The same can be said for HTTP 2. On Node and Bun, those requests are not rejected internally and is passed to the user land. For those requests, the value of http.IncomingMessage.url contains #. Vite a", "references": ["https://github.com/vitejs/vite/security/advisories/GHSA-356w-63v5-8wf4", "https://github.com/vitejs/vite/commit/175a83909f02d3b554452a7bd02b9f340cdfef70", "https://nvd.nist.gov/vuln/detail/CVE-2025-32395"], "fixes": ["4.5.13", "5.4.18", "6.0.15", "6.1.5", "6.2.6"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2025-31486", "noindex": false, "published": "2025-04-03T18:24:39.616Z", "modified": "2025-04-03T20:39:28.939Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.40461, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-31486", "title": "Vite allows server.fs.deny to be bypassed with .svg or relative paths", "description": "Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.", "references": ["https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x", "https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647", "https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290"], "fixes": ["4.5.12", "5.4.17", "6.0.14", "6.1.4", "6.2.5"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2025-31125", "noindex": false, "published": "2025-03-31T17:06:30.704Z", "modified": "2026-01-23T16:58:37.048Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.65756, "kev": true, "exploits": ["nuclei"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-31125", "title": "Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query", "description": "Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.", "references": ["https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8", "https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31125"], "fixes": ["4.5.11", "5.4.16", "6.0.13", "6.1.3", "6.2.4"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}, {"id": "CVE-2025-30208", "noindex": false, "published": "2025-03-24T17:03:40.728Z", "modified": "2025-03-24T17:46:37.205Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.74771, "kev": false, "exploits": ["exploitdb", "nuclei", "public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2025-30208", "title": "Vite bypasses server.fs.deny when using `?raw??`", "description": "Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versio", "references": ["https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w", "https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4", "https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c"], "fixes": ["4.5.10", "5.4.15", "6.0.12", "6.1.2", "6.2.3"], "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}, {"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}]}], "total": 28, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "vite", "path": "vulns/npm/vite", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 6, "kev": 0}, "lastmod": "2026-10-21T15:55:05.963Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}