Skip to content
OpenAdvisories

Product · vitejs

vite-plus

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-112942

    launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

    launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-co…

    vitejs vite vite-plus launch-editor Wolfi npm
  • High 8.2
    CVE-2026-39364 Scanner template

    Vite has a `server.fs.deny` bypass with queries

    Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, …

    vitejs vite vite-plus vitess-23 Wolfi npm
  • High 8.2
    CVE-2026-39363 Public exploit Scanner template

    Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

    Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite…

    vitejs vite vite-plus langfuse-3-worker Wolfi npm