Skip to content
OpenAdvisories

Package · npm

vite

29 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2026-53571 Public exploit

    Vite: `server.fs.deny` bypass on Windows alternate paths

    Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through ser…

    vitejs vite vite vite-plus npm
  • High 7.5
    CVE-2024-52011 Public exploit

    launch-editor vulnerable to command injection via the crafted request on Windows

    launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a …

    vitejs vite launch-editor vite npm
  • High 8.2
    CVE-2026-39363 Public exploit

    Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

    Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite…

    vitejs vite vite-plus vite npm