Skip to content
OpenAdvisories

Package · npm

vite

29 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.5
    CVE-2026-112942

    launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

    launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-co…

    vitejs vite vite-plus launch-editor Wolfi npm
  • High 8.2
    CVE-2026-53571 Public exploit

    Vite: `server.fs.deny` bypass on Windows alternate paths

    Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through ser…

    vitejs vite nextcloud-server-33 vite Wolfi npm
  • High 7.5
    CVE-2024-52011 Public exploit

    launch-editor vulnerable to command injection via the crafted request on Windows

    launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a …

    vitejs vite launch-editor vite npm
  • High 8.2
    CVE-2026-39364 Scanner template

    Vite has a `server.fs.deny` bypass with queries

    Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, …

    vitejs vite vite-plus vitess-23 Wolfi npm
  • High 8.2
    CVE-2026-39363 Public exploit Scanner template

    Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

    Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite…

    vitejs vite vite-plus langfuse-3-worker Wolfi npm
  • High 7.5
    CVE-2024-23331

    Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

    Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is simila…

    vitejs vite vite vite Wolfi npm
  • High 7.5
    CVE-2023-34092 Scanner template

    Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

    Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the…

    vitejs vite vite npm
  • High 8.6
    CVE-2022-35204

    Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service

    Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service.

    vite npm