Skip to content
Vitejs Vite-plus vulnerabilities
-
@vitest browser, ui, vitest-dev vitest +1 more +3 more
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
CVE-2026-112948
Fix available
6.5 Medium
-
vitejs vite, vite-plus +1 more
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
CVE-2026-112947
Fix available
6.3 Medium
-
vitejs vite, vite-plus +1 more
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
CVE-2026-112946
Fix available
6.3 Medium
-
vitejs vite, vite-plus +1 more
Vite: Cross origin script execution through Vite custom middleware
CVE-2026-112945
Fix available
2.1 Low
-
vitejs launch-editor, vite, vite-plus +2 more
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
CVE-2026-112944
Fix available
6.3 Medium
-
vitejs launch-editor, vite, vite-plus +2 more
launch-editor: escapeCmdArgs() omits % escaping on Windows
CVE-2026-112943
Fix available
6.3 Medium
-
vitejs launch-editor, vite, vite-plus +2 more
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
CVE-2026-112942
Fix available
7.5 High
-
vitejs launch-editor, vite, vite-plus +2 more
NTLMv2 hash disclosure via UNC path handling on Windows
CVE-2026-53632
Fix available
5.5 Medium
-
vitejs vite, vite-plus, voidzero vite\+ +2 more
Vite has a Path Traversal in Optimized Deps `.map` Handling
CVE-2026-39365
Fix available
6.3 Medium
-
vitejs vite, red hat advanced cluster security 4, ansible automation platform 2 +9 more +11 more
Vite has a `server.fs.deny` bypass with queries
CVE-2026-39364
8.2 High
-
vitejs vite, red hat advanced cluster security 4, ansible automation platform 2 +13 more +15 more
Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket
CVE-2026-39363
Public exploitFix available
8.2 High