{"id":"CVE-2025-30208","aliases":["CLSA-2026-1775089661","CLSA-2026-1775176118","CLSA-2026-1777509608","CLSA-2026-1777509610","CLSA-2026-1789031855","CLSA-2026-1790801785","CLSA-2026-1790803771","CLSA-2026-1790804788","CLSA-2026-1792225950","CLSA-2026-1792225952","EUVD-2025-8079","GHSA-4w7w-66w2-5vf9","GHSA-x574-m823-4x7w","ROOT-APP-NPM-CVE-2025-30208"],"status":"published","title":"Vite bypasses server.fs.deny when using `?raw??`","description":"Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import\u0026raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.74771,"percentile":0.99509,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-200","CWE-284"],"published":"2025-03-24T17:03:40Z","modified":"2026-11-04T10:45:50Z","exploits":[{"source":"pocgithub","id":"MiclelsonCN/CVE-2025-30208_POC","title":"MiclelsonCN/CVE-2025-30208_POC","date":"2025-03-26","url":"https://github.com/MiclelsonCN/CVE-2025-30208_POC"},{"source":"pocgithub","id":"ThumpBo/CVE-2025-30208-EXP","title":"ThumpBo/CVE-2025-30208-EXP","date":"2025-03-26","url":"https://github.com/ThumpBo/CVE-2025-30208-EXP"},{"source":"pocgithub","id":"marino-admin/Vite-CVE-2025-30208-Scanner","title":"marino-admin/Vite-CVE-2025-30208-Scanner","date":"2025-03-26","url":"https://github.com/marino-admin/Vite-CVE-2025-30208-Scanner"},{"source":"pocgithub","id":"xuemian168/CVE-2025-30208","title":"xuemian168/CVE-2025-30208","date":"2025-03-26","url":"https://github.com/xuemian168/CVE-2025-30208"},{"source":"pocgithub","id":"4xura/CVE-2025-30208","title":"4xura/CVE-2025-30208","date":"2025-03-27","url":"https://github.com/4xura/CVE-2025-30208"},{"source":"pocgithub","id":"On1onss/CVE-2025-30208","title":"On1onss/CVE-2025-30208","date":"2025-03-27","url":"https://github.com/On1onss/CVE-2025-30208"},{"source":"pocgithub","id":"iSee857/CVE-2025-30208-PoC","title":"iSee857/CVE-2025-30208-PoC","date":"2025-03-27","url":"https://github.com/iSee857/CVE-2025-30208-PoC"},{"source":"pocgithub","id":"keklick1337/CVE-2025-30208-ViteVulnScanner","title":"keklick1337/CVE-2025-30208-ViteVulnScanner","date":"2025-03-28","url":"https://github.com/keklick1337/CVE-2025-30208-ViteVulnScanner"},{"source":"pocgithub","id":"sadhfdw129/CVE-2025-30208-Vite","title":"sadhfdw129/CVE-2025-30208-Vite","date":"2025-03-28","url":"https://github.com/sadhfdw129/CVE-2025-30208-Vite"},{"source":"pocgithub","id":"jackieya/ViteVulScan","title":"jackieya/ViteVulScan","date":"2025-03-31","url":"https://github.com/jackieya/ViteVulScan"},{"source":"pocgithub","id":"0xshaheen/CVE-2025-30208","title":"0xshaheen/CVE-2025-30208","date":"2025-04-02","url":"https://github.com/0xshaheen/CVE-2025-30208"},{"source":"pocgithub","id":"sumeet-darekar/CVE-2025-30208","title":"sumeet-darekar/CVE-2025-30208","date":"2025-04-02","url":"https://github.com/sumeet-darekar/CVE-2025-30208"},{"source":"pocgithub","id":"4m3rr0r/CVE-2025-30208-PoC","title":"4m3rr0r/CVE-2025-30208-PoC","date":"2025-04-03","url":"https://github.com/4m3rr0r/CVE-2025-30208-PoC"},{"source":"exploitdb","id":"EDB-52111","title":"Vite 6.2.2 - Arbitrary File Read","type":"remote","platform":"multiple","date":"2025-04-03","url":"https://www.exploit-db.com/exploits/52111"},{"source":"pocgithub","id":"lilil3333/Vite-CVE-2025-30208-EXP","title":"lilil3333/Vite-CVE-2025-30208-EXP","date":"2025-04-05","url":"https://github.com/lilil3333/Vite-CVE-2025-30208-EXP"},{"source":"pocgithub","id":"imbas007/CVE-2025-30208-template","title":"imbas007/CVE-2025-30208-template","date":"2025-04-21","url":"https://github.com/imbas007/CVE-2025-30208-template"},{"source":"pocgithub","id":"r0ngy40/CVE-2025-30208-Series","title":"r0ngy40/CVE-2025-30208-Series","date":"2025-04-24","url":"https://github.com/r0ngy40/CVE-2025-30208-Series"},{"source":"pocgithub","id":"nkuty/CVE-2025-30208-31125-31486-32395","title":"nkuty/CVE-2025-30208-31125-31486-32395","date":"2025-05-29","url":"https://github.com/nkuty/CVE-2025-30208-31125-31486-32395"},{"source":"pocgithub","id":"HaGsec/CVE-2025-30208","title":"HaGsec/CVE-2025-30208","date":"2025-06-06","url":"https://github.com/HaGsec/CVE-2025-30208"},{"source":"pocgithub","id":"ThemeHackers/CVE-2025-30208","title":"ThemeHackers/CVE-2025-30208","date":"2025-06-27","url":"https://github.com/ThemeHackers/CVE-2025-30208"},{"source":"pocgithub","id":"TH-SecForge/CVE-2025-30208","title":"TH-SecForge/CVE-2025-30208","date":"2025-06-29","url":"https://github.com/TH-SecForge/CVE-2025-30208"},{"source":"pocgithub","id":"HazaVVIP/CVE-2025-30208","title":"HazaVVIP/CVE-2025-30208","date":"2026-03-04","url":"https://github.com/HazaVVIP/CVE-2025-30208"},{"source":"pocgithub","id":"cc3305/CVE-2025-30208","title":"cc3305/CVE-2025-30208","date":"2026-06-16","url":"https://github.com/cc3305/CVE-2025-30208"},{"source":"pocgithub","id":"Minseo9503/cve-2025-30208","title":"Minseo9503/cve-2025-30208","date":"2026-09-29","url":"https://github.com/Minseo9503/cve-2025-30208"},{"source":"pocgithub","id":"L15B04/Exploit-VITE-CVE-2025-30208-CVE-2025-31125","title":"L15B04/Exploit-VITE-CVE-2025-30208-CVE-2025-31125","date":"2026-10-18","url":"https://github.com/L15B04/Exploit-VITE-CVE-2025-30208-CVE-2025-31125"},{"source":"nuclei","id":"CVE-2025-30208","title":"Vite - Arbitrary File Read","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-30208.yaml"}],"fixes":[{"ecosystem":"npm","package":"vite","fixed_in":["6.2.3","6.1.2","6.0.12","5.4.15","4.5.10"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"@rootio/vite","fixed_in":["2.9.18-root.io.1","2.9.18-root.io.2","2.9.18-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"vite","fixed_in":["2.9.18-aikido.2","2.9.18-aikido.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.1.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.12"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.4.15"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.10"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.14-tuxcare.0"},{"fixed":"5.4.14-tuxcare.1"}]}],"versions":["5.4.14"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.14-tuxcare.0"},{"fixed":"5.4.14-tuxcare.1"}]}],"versions":["5.4.14"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.5-tuxcare.0"},{"fixed":"4.5.5-tuxcare.1"}]}],"versions":["4.5.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.1"}]}],"versions":["2.9.18"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.11-tuxcare.0"},{"fixed":"3.2.11-tuxcare.1"}]}],"versions":["3.2.11"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.5-tuxcare.0"},{"fixed":"4.1.5-tuxcare.1"}]}],"versions":["4.1.5"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.12-tuxcare.0"},{"fixed":"5.0.12-tuxcare.1"}]}],"versions":["5.0.12"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.1"}]}],"versions":["4.5.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.10-tuxcare.0"},{"fixed":"5.4.10-tuxcare.1"}]}],"versions":["5.4.10"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.1"}]}],"versions":["2.9.18"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.11-tuxcare.0"},{"fixed":"3.2.11-tuxcare.1"}]}],"versions":["3.2.11"],"bundled":6},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"6.2.0"},{"fixed":"6.2.3"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"6.1.0"},{"fixed":"6.1.2"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.0.12"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.4.15"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.10"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.18-root.io.1"},{"fixed":"2.9.18-root.io.2"},{"fixed":"2.9.18-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.18-aikido.2"},{"fixed":"2.9.18-aikido.3"}]}]}],"products":[{"vendor":"vitejs","product":"vite"}],"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w","tags":["x_refsource_CONFIRM","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/vitejs/vite/commit/807d7f06d33ab49c48a2a3501da3eea1906c0d41","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/vitejs/vite/commit/92ca12dc79118bf66f2b32ff81ed09e0d0bd07ca","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/vitejs/vite/commit/f234b5744d8b74c95535a7b82cc88ed2144263c1","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30208","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x574-m823-4x7w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30208.json","tags":["advisory"]},{"url":"https://github.com/vitejs/vite","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-30208","title":"Vite bypasses server.fs.deny when using `?raw??`","description":"Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import\u0026raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.","status":"published","published":"2025-03-24T17:03:40.728Z","modified":"2025-03-24T17:46:37.205Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-02T14:32:35.099955Z"}],"euvd":[{"id":"EUVD-2025-8079","description":"Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import\u0026raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.","status":"published","published":"2025-03-24T17:03:40Z","modified":"2025-03-24T17:46:37Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:54.592858Z"}],"ghsa":[{"id":"GHSA-x574-m823-4x7w","title":"Vite bypasses server.fs.deny when using ?raw??","description":"### Summary\nThe contents of arbitrary files can be returned to the browser.\n\n### Impact\nOnly apps explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.\n\n### Details\n`@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import\u0026raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes.\n\n### PoC\n```bash\n$ npm create vite@latest\n$ cd vite-project/\n$ npm install\n$ npm run dev\n\n$ echo \"top secret content\" \u003e /tmp/secret.txt\n\n# expected behaviour\n$ curl \"http://localhost:5173/@fs/tmp/secret.txt\"\n\n    \u003cbody\u003e\n      \u003ch1\u003e403 Restricted\u003c/h1\u003e\n      \u003cp\u003eThe request url \u0026quot;/tmp/secret.txt\u0026quot; is outside of Vite serving allow list.\n\n# security bypassed\n$ curl \"http://localhost:5173/@fs/tmp/secret.txt?import\u0026raw??\"\nexport default \"top secret content\\n\"\n//# sourceMappingURL=data:application/json;base64,eyJ2...\n```","status":"published","published":"2025-03-25T14:00:02Z","modified":"2025-03-25T14:00:04Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-02T14:38:36.51789Z"}],"nvd":[{"id":"CVE-2025-30208","description":"Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import\u0026raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.","status":"published","published":"2025-03-24T17:15:21.82Z","modified":"2026-06-17T09:08:21.517Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-02T14:10:55.858901Z"}],"osv":[{"id":"CVE-2025-30208","title":"Vite bypasses server.fs.deny when using `?raw??`","description":"Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import\u0026raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.","status":"published","published":"2025-03-24T17:03:40.728Z","modified":"2026-11-04T10:45:50.381245835Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-04T11:07:13.540858Z"},{"id":"GHSA-x574-m823-4x7w","title":"Vite bypasses server.fs.deny when using ?raw??","description":"### Summary\nThe contents of arbitrary files can be returned to the browser.\n\n### Impact\nOnly apps explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.\n\n### Details\n`@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import\u0026raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes.\n\n### PoC\n```bash\n$ npm create vite@latest\n$ cd vite-project/\n$ npm install\n$ npm run dev\n\n$ echo \"top secret content\" \u003e /tmp/secret.txt\n\n# expected behaviour\n$ curl \"http://localhost:5173/@fs/tmp/secret.txt\"\n\n    \u003cbody\u003e\n      \u003ch1\u003e403 Restricted\u003c/h1\u003e\n      \u003cp\u003eThe request url \u0026quot;/tmp/secret.txt\u0026quot; is outside of Vite serving allow list.\n\n# security bypassed\n$ curl \"http://localhost:5173/@fs/tmp/secret.txt?import\u0026raw??\"\nexport default \"top secret content\\n\"\n//# sourceMappingURL=data:application/json;base64,eyJ2...\n```","status":"published","published":"2025-03-25T14:00:02Z","modified":"2026-09-10T03:50:23.379149181Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"CLSA-2026-1775089661","title":"TuxCare security update for 2 packages (5 CVEs)","description":"TuxCare rebuilt 2 packages to address 5 CVEs. Fixed in 5.4.14-tuxcare.1.","status":"published","published":"2026-08-04T14:52:20Z","modified":"2026-10-15T09:47:49.386394056Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775176118","title":"TuxCare security update for vite (6 CVEs)","description":"TuxCare rebuilt vite to address 6 CVEs. Fixed in 4.5.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:20Z","modified":"2026-10-29T19:45:49.047753795Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1777509608","title":"TuxCare security update for vite (11 CVEs)","description":"TuxCare rebuilt vite to address 11 CVEs. Fixed in 2.9.18-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-29T19:45:49.027696506Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777509610","title":"TuxCare security update for vite (6 CVEs)","description":"TuxCare rebuilt vite to address 6 CVEs. Fixed in 3.2.11-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-29T19:45:48.668881699Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1789031855","title":"TuxCare security update for vite (16 CVEs)","description":"TuxCare rebuilt vite to address 16 CVEs. Fixed in 4.1.5-tuxcare.1.","status":"published","published":"2026-09-10T09:17:35Z","modified":"2026-10-15T09:47:55.69239765Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1790801785","title":"TuxCare security update for vite (3 CVEs)","description":"TuxCare rebuilt vite to address 3 CVEs. Fixed in 5.0.12-tuxcare.1.","status":"published","published":"2026-09-30T20:56:25Z","modified":"2026-10-15T09:47:41.931265189Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790803771","title":"TuxCare security update for vite (3 CVEs)","description":"TuxCare rebuilt vite to address 3 CVEs. Fixed in 4.5.0-tuxcare.1.","status":"published","published":"2026-09-30T21:29:31Z","modified":"2026-10-15T09:47:41.932696368Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790804788","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 5.4.10-tuxcare.1.","status":"published","published":"2026-09-30T21:46:28Z","modified":"2026-10-15T09:47:42.023166804Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792225950","title":"TuxCare security update for @vitejs/plugin-react (11 CVEs)","description":"TuxCare rebuilt @vitejs/plugin-react to address 11 CVEs. Fixed in 2.9.18-tuxcare.1.","status":"published","published":"2026-10-17T08:32:30Z","modified":"2026-10-17T13:09:25.089676995Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792225952","title":"TuxCare security update for @vitejs/plugin-react (6 CVEs)","description":"TuxCare rebuilt @vitejs/plugin-react to address 6 CVEs. Fixed in 3.2.11-tuxcare.1.","status":"published","published":"2026-10-17T08:32:31Z","modified":"2026-10-17T13:09:24.527313649Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"ROOT-APP-NPM-CVE-2025-30208","title":"CVE-2025-30208 in @rootio/vite - Patched by Root","description":"Root has patched CVE-2025-30208 in the @rootio/vite package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-07T10:02:25Z","modified":"2026-06-07T14:15:03.721135366Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}