Skip to content
OpenAdvisories

Vendor

vitejs

31 known vulnerabilities.

Products

vite 28 vite-plus 11 launch-editor 5 vite-plugin-react 2
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 2.1
    CVE-2026-112945

    Vite: Cross origin script execution through Vite custom middleware

    Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the que…

    vitejs vite vite-plus vite Ubuntu npm
  • Low 2.3
    CVE-2025-58752

    Vite's `server.fs` settings were not applied to HTML files

    Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (usin…

    vitejs vite vite npm
  • Low 2.3
    CVE-2025-58751

    Vite middleware may serve files starting with the same name with the public directory

    Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev s…

    vitejs vite vite npm