Skip to content
OpenAdvisories

Package · npm

vite-plus

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-112942

    launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

    launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-co…

    vitejs vite vite-plus launch-editor Wolfi npm
  • High 8.2
    CVE-2026-53571 Public exploit

    Vite: `server.fs.deny` bypass on Windows alternate paths

    Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through ser…

    vitejs vite nextcloud-server-33 vite Wolfi npm
  • High 8.4
    CVE-2026-41211

    `vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME`

    Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `version` string and uses it directly in filesystem paths. A caller can supply `../` segments or an absolute path to esc…

    voidzero-dev vite-plus vite-plus npm