[ Vendor · 8 CVEs ]
vitejs
CVEs affecting vitejs published in the last 30 days, plus any vitejs CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-112945 | 20 Oct 2026 | CVSS 2.1 | Vite: Cross origin script execution through Vite custom middlewareVite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are… | Fix |
| CVE-2026-112946 | 20 Oct 2026 | CVSS 6.3 | Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machineVite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative… | Fix |
| CVE-2026-112947 | 20 Oct 2026 | CVSS 6.3 | Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be… | Fix |
| CVE-2026-112948 | 20 Oct 2026 | CVSS 6.5 | Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token fileVitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers… | Fix |
| CVE-2026-112942 | 20 Oct 2026 | CVSS 7.5 | launch-editor: `fs.existsSync()` existence check can be bypassed on Windowslaunch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an… | Fix |
| CVE-2026-112943 | 20 Oct 2026 | CVSS 6.3 | launch-editor: escapeCmdArgs() omits % escaping on Windowslaunch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when… | Fix |
| CVE-2026-112944 | 20 Oct 2026 | CVSS 6.3 | launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editorslaunch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry… | Fix |
| CVE-2025-31125 | 31 Mar 2025 | CVSS 7.5 | Vite Vitejs Improper Access ControlVite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps… | ExploitedFix |