Skip to content
OpenAdvisories

Package · Ubuntu

vite

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 6.3
    CVE-2026-112947

    Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

    Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-insta…

    vitejs vite vite-plus vite Ubuntu npm
  • Medium 6.3
    CVE-2026-112946

    Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

    Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Wind…

    vitejs vite vite-plus vite Ubuntu npm
  • Low 2.1
    CVE-2026-112945

    Vite: Cross origin script execution through Vite custom middleware

    Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the que…

    vitejs vite vite-plus vite Ubuntu npm