Vitejs Vite vulnerabilities

• vitejs vite Vite: `server.fs.deny` bypassed with queries CVE-2026-118662 Fix available 6.9 MediumOctober 28, 2026
• @vitest browser, ui, vitest-dev vitest +1 more +3 more Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file CVE-2026-112948 Fix available 6.5 MediumOctober 20, 2026
• vitejs vite, vite-plus +1 more Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` CVE-2026-112947 Fix available 6.3 MediumOctober 20, 2026
• vitejs vite, vite-plus +1 more Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine CVE-2026-112946 Fix available 6.3 MediumOctober 20, 2026
• vitejs vite, vite-plus +1 more Vite: Cross origin script execution through Vite custom middleware CVE-2026-112945 Fix available 2.1 LowOctober 20, 2026
• vitejs launch-editor, vite, vite-plus +2 more launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors CVE-2026-112944 Fix available 6.3 MediumOctober 20, 2026
• vitejs launch-editor, vite, vite-plus +2 more launch-editor: escapeCmdArgs() omits % escaping on Windows CVE-2026-112943 Fix available 6.3 MediumOctober 20, 2026
• vitejs launch-editor, vite, vite-plus +2 more launch-editor: `fs.existsSync()` existence check can be bypassed on Windows CVE-2026-112942 Fix available 7.5 HighOctober 20, 2026
• vitejs launch-editor, vite, vite-plus +2 more NTLMv2 hash disclosure via UNC path handling on Windows CVE-2026-53632 Fix available 5.5 MediumJune 15, 2026
• vitejs vite, voidzero vite\+ +1 more Vite: `server.fs.deny` bypass on Windows alternate paths CVE-2026-53571 Public exploitFix available 8.2 HighJune 15, 2026
• vitejs launch-editor, vite, red hat cluster observability operator 1.5.0 +25 more +27 more launch-editor vulnerable to command injection via the crafted request on Windows CVE-2024-52011 Public exploitFix available 7.5 HighJune 1, 2026
• vitejs vite, vite-plus, voidzero vite\+ +2 more Vite has a Path Traversal in Optimized Deps `.map` Handling CVE-2026-39365 Fix available 6.3 MediumApril 7, 2026
• vitejs vite, red hat advanced cluster security 4, ansible automation platform 2 +9 more +11 more Vite has a `server.fs.deny` bypass with queries CVE-2026-39364 8.2 HighApril 7, 2026
• vitejs vite, red hat advanced cluster security 4, ansible automation platform 2 +13 more +15 more Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket CVE-2026-39363 Public exploitFix available 8.2 HighApril 6, 2026
• vitejs vite-plugin-react @vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development CVE-2025-68155 Fix available 7.5 HighDecember 16, 2025
• vitejs vite-plugin-react @vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server CVE-2025-67489 Fix available 9.8 CriticalDecember 8, 2025
• vitejs vite vite allows server.fs.deny bypass via backslash on Windows CVE-2025-62522 Fix available 6.0 MediumOctober 20, 2025
• vitejs vite Vite's `server.fs` settings were not applied to HTML files CVE-2025-58752 Fix available 2.3 LowSeptember 8, 2025
• vitejs vite Vite middleware may serve files starting with the same name with the public directory CVE-2025-58751 Fix available 2.3 LowSeptember 8, 2025
• vitejs vite Vite's server.fs.deny bypassed with /. for files under project root CVE-2025-46565 Fix available 6.0 MediumApril 30, 2025
• vitejs vite Vite has an `server.fs.deny` bypass with an invalid `request-target` CVE-2025-32395 Public exploitFix available 6.0 MediumApril 10, 2025
• vitejs vite Vite allows server.fs.deny to be bypassed with .svg or relative paths CVE-2025-31486 Public exploitFix available EPSS 40.5% 5.3 MediumApril 3, 2025
• vitejs vite, vite vitejs +1 more Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query CVE-2025-31125 In KEVPublic exploitFix available EPSS 74.9% 5.3 MediumMarch 31, 2025
• vitejs vite Vite bypasses server.fs.deny when using `?raw??` CVE-2025-30208 Public exploitFix available EPSS 74.8% 5.3 MediumMarch 24, 2025
• vitejs vite Vite allows any websites to send any requests to the development server and read the response CVE-2025-24010 Fix available 6.5 MediumJanuary 20, 2025
• vitejs vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite CVE-2024-45812 Fix available 6.4 MediumSeptember 17, 2024
• vitejs vite server.fs.deny bypassed when using ?import&raw in vite CVE-2024-45811 Fix available 4.8 MediumSeptember 17, 2024
• vitejs vite Vite's `server.fs.deny` did not deny requests for patterns with directories CVE-2024-31207 Fix available 5.9 MediumApril 3, 2024
• vitejs vite Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem CVE-2024-23331 Fix available 7.5 HighJanuary 19, 2024
• vitejs vite Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite CVE-2023-49293 Fix available 6.1 MediumDecember 4, 2023
• vitejs vite Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) CVE-2023-34092 Fix available 7.5 HighJune 1, 2023
• vitejs vite Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service CVE-2022-35204 Fix available 4.3 MediumAugust 18, 2022