Vite (Vitejs) - vulnerabilities (CVEs)

28 CVEs, 7 in the last 30 days, 589 known versions, newest CVE from 2026-10-28. Vendor: Vitejs.

CVEs of Vite

CVE-2026-118662 - CVSS 6.9 (medium), 2026-10-28: Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader…
CVE-2026-112947 - CVSS 6.3 (medium), 2026-10-20: Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned…
CVE-2026-112946 - CVSS 6.3 (medium), 2026-10-20: Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in…
CVE-2026-112945 - CVSS 2.1 (low), 2026-10-20: Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when…
CVE-2026-112944 - CVSS 6.3 (medium), 2026-10-20: launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning…
CVE-2026-112943 - CVSS 6.3 (medium), 2026-10-20: launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an…
CVE-2026-112942 - CVSS 7.5 (high), 2026-10-20: launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled…
CVE-2026-53571 - CVSS 8.2 (high), 2026-06-22: Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be…
CVE-2026-53632 - CVSS 5.5 (medium), 2026-06-22: launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths…
CVE-2024-52011 - CVSS 8.3 (high), 2026-06-01: launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file`…
CVE-2026-39364 - CVSS 8.2 (high), 2026-04-07: Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by…
CVE-2026-39363 - CVSS 8.2 (high), 2026-04-07: Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s…
CVE-2026-39365 - CVSS 6.3 (medium), 2026-04-07: Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized…
CVE-2025-62522 - CVSS 6 (medium), 2025-10-20: Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before…
CVE-2025-58752 - CVSS 5.3 (medium), 2025-09-08: Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless…
CVE-2025-58751 - CVSS 5.3 (medium), 2025-09-08: Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public…
CVE-2025-46565 - CVSS 6 (medium), 2025-05-01: Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that…
CVE-2025-32395 - CVSS 6 (medium), 2025-04-10: Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the…
CVE-2025-31486 - CVSS 5.3 (medium), 2025-04-03: Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with…
CVE-2025-31125 - CVSS 7.5 (high), 2025-03-31: Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly…
CVE-2025-30208 - CVSS 7.5 (high), 2025-03-24: Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to…
CVE-2025-24010 - CVSS 6.5 (medium), 2025-01-20: Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to…
CVE-2024-45812 - CVSS 6.4 (medium), 2024-09-17: Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building…
CVE-2024-45811 - CVSS 4.8 (medium), 2024-09-17: Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies…
CVE-2024-31207 - CVSS 5.9 (medium), 2024-04-04: Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does…
CVE-2024-23331 - CVSS 7.5 (high), 2024-01-19: Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using…
CVE-2023-49293 - CVSS 6.1 (medium), 2023-12-04: Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original request URL is passed…
CVE-2023-34092 - CVSS 7.5 (high), 2023-06-01: Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using…
CVE-2022-35204 - CVSS 4.3 (medium), 2022-08-18: Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service.