Skip to content
OpenAdvisories

Package · Wolfi

vite

18 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.2
    CVE-2026-39364 Scanner template

    Vite has a `server.fs.deny` bypass with queries

    Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, …

    vitejs vite vite-plus vitess-23 Wolfi npm
  • High 8.2
    CVE-2026-39363 Public exploit Scanner template

    Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

    Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite…

    vitejs vite vite-plus langfuse-3-worker Wolfi npm
  • High 7.5
    CVE-2026-33671 Public exploit

    Picomatch has a ReDoS vulnerability via extglob quantifiers

    Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*(…

    micromatch picomatch katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi npm
  • High 8.8
    CVE-2026-27606 Public exploit

    Rollup 4 has Arbitrary File Write via Path Traversal

    Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization…

    rollup rollup langfuse-3-worker langfuse-3 Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2024-24784

    Comments in display names are incorrectly handled in net/mail

    The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

    Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2024-23331

    Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

    Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is simila…

    vitejs vite vite vite Wolfi npm