Voidzero-dev Vite-plus vulnerabilities

• @vitest browser, ui, vitest-dev vitest +1 more +3 more Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file CVE-2026-112948 Fix available 6.5 MediumOctober 20, 2026
• vitejs vite, vite-plus +1 more Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` CVE-2026-112947 Fix available 6.3 MediumOctober 20, 2026
• vitejs vite, vite-plus +1 more Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine CVE-2026-112946 Fix available 6.3 MediumOctober 20, 2026
• vitejs vite, vite-plus +1 more Vite: Cross origin script execution through Vite custom middleware CVE-2026-112945 Fix available 2.1 LowOctober 20, 2026
• vitejs launch-editor, vite, vite-plus +2 more launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors CVE-2026-112944 Fix available 6.3 MediumOctober 20, 2026
• vitejs launch-editor, vite, vite-plus +2 more launch-editor: escapeCmdArgs() omits % escaping on Windows CVE-2026-112943 Fix available 6.3 MediumOctober 20, 2026
• vitejs launch-editor, vite, vite-plus +2 more launch-editor: `fs.existsSync()` existence check can be bypassed on Windows CVE-2026-112942 Fix available 7.5 HighOctober 20, 2026
• vitejs launch-editor, vite, vite-plus +2 more NTLMv2 hash disclosure via UNC path handling on Windows CVE-2026-53632 Fix available 5.5 MediumJune 15, 2026
• voidzero-dev vite-plus, voidzero vite\+ +1 more `vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME` CVE-2026-41211 Fix available 8.4 HighApril 16, 2026
• vitejs vite, vite-plus, voidzero vite\+ +2 more Vite has a Path Traversal in Optimized Deps `.map` Handling CVE-2026-39365 Fix available 6.3 MediumApril 7, 2026
• vitejs vite, red hat advanced cluster security 4, ansible automation platform 2 +9 more +11 more Vite has a `server.fs.deny` bypass with queries CVE-2026-39364 Fix available 8.2 HighApril 7, 2026
• vitejs vite, red hat advanced cluster security 4, ansible automation platform 2 +13 more +15 more Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket CVE-2026-39363 Public exploitFix available 8.2 HighApril 6, 2026