p PatchFirst

PatchFirst · Latest vulnerabilities

vite vulnerabilities

Vulnerabilities published for vite in the last 30 days: 6. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 28

  1. CVE-2026-112947

    Medium · CVSS 6.3EPSS 0.42%Public exploitFix available

    Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

    Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal Wasm plugin's load hook. The hook removes the query and reads the resulting path directly from disk, but the server.fs checks were not applied. After reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file. This vulnerability is fixed in 8.2.4 and 8.3.

    vite viteNode.js
    • Update to 8.2.4
    • Update to 8.3.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-112946

    Medium · CVSS 6.3EPSS 0.85%Public exploitFix available

    Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

    Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by

    vite vite vite vite viteNode.js
    • Update to 6.4.4
    • Update to 7.3.7
    • Update to 8.1.6
    • Update to 8.2.4
    • Update to 8.3.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-112945

    Low · CVSS 2.1EPSS 0.47%Public exploitFix available

    Vite: Cross origin script execution through Vite custom middleware

    Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in the Vite-served page. This execut

    vite vite vite vite viteNode.js
    • Update to 6.4.4
    • Update to 7.3.7
    • Update to 8.1.6
    • Update to 8.2.4
    • Update to 8.3.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2026-112944

    Medium · CVSS 6.3EPSS 0.7%Fix available

    launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

    launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emac

    vite vite vite vite viteNode.js
    • Update to 6.4.4
    • Update to 7.3.7
    • Update to 8.1.6
    • Update to 8.2.4
    • Update to 8.3.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2026-112943

    Medium · CVSS 6.3EPSS 0.41%Fix available

    launch-editor: escapeCmdArgs() omits % escaping on Windows

    launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.

    vite vite vite vite viteNode.js
    • Update to 6.4.4
    • Update to 7.3.7
    • Update to 8.1.6
    • Update to 8.2.4
    • Update to 8.3.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2026-112942

    High · CVSS 7.5EPSS 1.33%Fix available

    launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

    launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with

    vite vite vite vite viteNode.js
    • Update to 6.4.4
    • Update to 7.3.7
    • Update to 8.1.6
    • Update to 8.2.4
    • Update to 8.3.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. CVE-2026-53571

    High · CVSS 8.2EPSS 0.58%Fix available

    Vite: `server.fs.deny` bypass on Windows alternate paths

    Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file

    vite vite viteNode.js
    • Update to 6.4.3
    • Update to 7.3.5
    • Update to 8.0.16
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2026-53632

    Medium · CVSS 5.5EPSS 0.41%Fix available

    NTLMv2 hash disclosure via UNC path handling on Windows

    launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.

    vite vite viteNode.js
    • Update to 6.4.3
    • Update to 7.3.5
    • Update to 8.0.16
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2024-52011

    High · CVSS 7.5EPSS 0.51%Fix available

    launch-editor vulnerable to command injection via the crafted request on Windows

    launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.

    viteNode.js
    • Update to 5.4.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. CVE-2026-39365

    Medium · CVSS 6.3EPSS 0.98%Public exploitFix available

    Vite has a Path Traversal in Optimized Deps `.map` Handling

    Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.

    vite vite viteNode.js
    • Update to 6.4.2
    • Update to 7.3.2
    • Update to 8.0.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  11. CVE-2026-39364

    High · CVSS 8.2EPSS 1.54%Public exploitFix available

    Vite has a `server.fs.deny` bypass with queries

    Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.

    vite viteNode.js
    • Update to 7.3.2
    • Update to 8.0.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2026-39363

    High · CVSS 8.2EPSS 2.62%Public exploitFix available

    Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

    Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "..."). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.

    vite vite viteNode.js
    • Update to 6.4.2
    • Update to 7.3.2
    • Update to 8.0.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2025-62522

    Medium · CVSS 6EPSS 1.05%Public exploitFix available

    vite allows server.fs.deny bypass via backslash on Windows

    Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.

    vite vite vite vite vite vite viteNode.js
    • Update to 5.4.21
    • Update to 6.4.1
    • Update to 7.0.8
    • Update to 7.1.11
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. CVE-2025-58752

    Low · CVSS 2.3EPSS 0.61%Fix available

    Vite's `server.fs` settings were not applied to HTML files

    Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: 'spa'` (default) or `appType: 'mpa'` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.

    vite vite vite viteNode.js
    • Update to 5.4.20
    • Update to 6.3.6
    • Update to 7.0.7
    • Update to 7.1.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2025-58751

    Low · CVSS 2.3EPSS 1.21%Public exploitFix available

    Vite middleware may serve files starting with the same name with the public directory

    Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.

    vite vite vite viteNode.js
    • Update to 5.4.20
    • Update to 6.3.6
    • Update to 7.0.7
    • Update to 7.1.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2025-46565

    Medium · CVSS 6EPSS 1.17%Public exploitFix available

    Vite's server.fs.deny bypassed with /. for files under project root

    Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. `server.fs.deny` can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under `root` by using a c

    vite vite vite vite viteNode.js
    • Update to 4.5.14
    • Update to 5.4.19
    • Update to 6.1.6
    • Update to 6.2.7
    • Update to 6.3.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2025-32395

    Medium · CVSS 6EPSS 1.77%Public exploitFix available

    Vite has an `server.fs.deny` bypass with an invalid `request-target`

    Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec (RFC 9112) does not allow # in request-target. Although an attacker can send such a request. For those requests with an invalid request-line (it includes request-target), the spec recommends to reject them with 400 or 301. The same can be said for HTTP 2. On Node and Bun, those requests are not rejected internally and is passed to the user land. For those requests, the value of http.IncomingMessage.url contains #. Vite a

    vite vite vite vite viteNode.js
    • Update to 4.5.13
    • Update to 5.4.18
    • Update to 6.0.15
    • Update to 6.1.5
    • Update to 6.2.6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2025-31486

    Medium · CVSS 5.3EPSS 40.46%Public exploitFix available

    Vite allows server.fs.deny to be bypassed with .svg or relative paths

    Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.

    vite vite vite vite viteNode.js
    • Update to 4.5.12
    • Update to 5.4.17
    • Update to 6.0.14
    • Update to 6.1.4
    • Update to 6.2.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. CVE-2025-31125

    Medium · CVSS 5.3EPSS 65.76%In KEVPublic exploitFix available

    Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

    Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

    vite vite vite vite viteNode.js
    • Update to 4.5.11
    • Update to 5.4.16
    • Update to 6.0.13
    • Update to 6.1.3
    • Update to 6.2.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2025-30208

    Medium · CVSS 5.3EPSS 74.77%Public exploitFix available

    Vite bypasses server.fs.deny when using `?raw??`

    Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versio

    vite vite vite vite viteNode.js
    • Update to 4.5.10
    • Update to 5.4.15
    • Update to 6.0.12
    • Update to 6.1.2
    • Update to 6.2.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →