Vitejs - vulnerabilities (CVEs)

32 CVEs in 4 products, 8 in the last 30 days, newest from 2026-10-28.

Products

Vite - 28 CVEs
Vite-plus - 11 CVEs
Launch-editor - 5 CVEs
Vite-plugin-react - 2 CVEs

Newest CVEs of Vitejs

CVE-2026-118662 - CVSS 6.9 (medium), 2026-10-28: Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader…
CVE-2026-112948 - CVSS 6.5 (medium), 2026-10-20: Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace…
CVE-2026-112947 - CVSS 6.3 (medium), 2026-10-20: Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned…
CVE-2026-112946 - CVSS 6.3 (medium), 2026-10-20: Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in…
CVE-2026-112945 - CVSS 2.1 (low), 2026-10-20: Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when…
CVE-2026-112944 - CVSS 6.3 (medium), 2026-10-20: launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning…
CVE-2026-112943 - CVSS 6.3 (medium), 2026-10-20: launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an…
CVE-2026-112942 - CVSS 7.5 (high), 2026-10-20: launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled…
CVE-2026-53571 - CVSS 8.2 (high), 2026-06-22: Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be…
CVE-2026-53632 - CVSS 5.5 (medium), 2026-06-22: launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths…
CVE-2024-52011 - CVSS 8.3 (high), 2026-06-01: launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file`…
CVE-2026-39365 - CVSS 6.3 (medium), 2026-04-07: Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized…
CVE-2026-39364 - CVSS 8.2 (high), 2026-04-07: Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by…
CVE-2026-39363 - CVSS 8.2 (high), 2026-04-07: Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s…
CVE-2025-68155 - CVSS 7.5 (high), 2025-12-16: @vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the `/__vite_rsc_findSourceMapURL` endpoint in…
CVE-2025-67489 - CVSS 9.8 (critical), 2025-12-09: @vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the…
CVE-2025-62522 - CVSS 6 (medium), 2025-10-20: Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before…
CVE-2025-58752 - CVSS 5.3 (medium), 2025-09-08: Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless…
CVE-2025-58751 - CVSS 5.3 (medium), 2025-09-08: Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public…
CVE-2025-46565 - CVSS 6 (medium), 2025-05-01: Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that…
CVE-2025-32395 - CVSS 6 (medium), 2025-04-10: Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the…
CVE-2025-31486 - CVSS 5.3 (medium), 2025-04-03: Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with…
CVE-2025-31125 - CVSS 7.5 (high), 2025-03-31: Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly…
CVE-2025-30208 - CVSS 7.5 (high), 2025-03-24: Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to…
CVE-2025-24010 - CVSS 6.5 (medium), 2025-01-20: Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to…
CVE-2024-45812 - CVSS 6.4 (medium), 2024-09-17: Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building…
CVE-2024-45811 - CVSS 4.8 (medium), 2024-09-17: Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies…
CVE-2024-31207 - CVSS 5.9 (medium), 2024-04-04: Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does…
CVE-2024-23331 - CVSS 7.5 (high), 2024-01-19: Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using…
CVE-2023-49293 - CVSS 6.1 (medium), 2023-12-04: Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original request URL is passed…