vite-plus vulnerabilities (npm)
11 vulnerabilities.
-
vite-plusnpm Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file 6.5 Medium -
vite-plusnpm Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` 6.3 Medium -
vite-plusnpm Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine 6.3 Medium -
vite-plusnpm Vite: Cross origin script execution through Vite custom middleware 2.1 Low -
vite-plusnpm launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors 6.3 Medium -
vite-plusnpm launch-editor: escapeCmdArgs() omits % escaping on Windows 6.3 Medium -
vite-plusnpm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows 7.5 High -
vite-plusnpm Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE 9.8 Critical -
vite-plusnpm NTLMv2 hash disclosure via UNC path handling on Windows 5.5 Medium -
vite-plusnpm Vite: `server.fs.deny` bypass on Windows alternate paths 8.2 High -
vite-plusnpm `vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME` 8.4 High