vitejs vite

• CVE-2025-31125 Medium 5.3 Exploited Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query 74.9%
• CVE-2026-118662 Medium 6.9 Vite: `server.fs.deny` bypassed with queries 0.3%
• CVE-2026-112947 Medium 6.3 Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` 0.5%
• CVE-2026-112946 Medium 6.3 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine 0.9%
• CVE-2026-112945 Low 2.1 Vite: Cross origin script execution through Vite custom middleware 0.7%
• CVE-2026-112944 Medium 6.3 launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors 0.7%
• CVE-2026-112943 Medium 6.3 launch-editor: escapeCmdArgs() omits % escaping on Windows 0.4%
• CVE-2026-112942 High 7.5 launch-editor: `fs.existsSync()` existence check can be bypassed on Windows 1.3%
• CVE-2026-53571 High 8.2 Vite: `server.fs.deny` bypass on Windows alternate paths 0.6%
• CVE-2026-53632 Medium 5.5 NTLMv2 hash disclosure via UNC path handling on Windows 0.4%
• CVE-2024-52011 High 8.3 launch-editor vulnerable to command injection via the crafted request on Windows 0.5%
• CVE-2026-39365 Medium 6.3 Vite has a Path Traversal in Optimized Deps `.map` Handling 0.9%
• CVE-2026-39364 High 7.5 Vite has a `server.fs.deny` bypass with queries 2.3%
• CVE-2026-39363 High 7.5 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket 3.4%
• CVE-2025-62522 Medium 6.0 vite allows server.fs.deny bypass via backslash on Windows 1.1%
• CVE-2025-58752 Low 2.3 Vite's `server.fs` settings were not applied to HTML files 0.6%
• CVE-2025-58751 Low 2.3 Vite middleware may serve files starting with the same name with the public directory 1.2%
• CVE-2025-46565 Medium 6.0 Vite's server.fs.deny bypassed with /. for files under project root 1.2%
• CVE-2025-32395 Medium 6.0 Vite has an `server.fs.deny` bypass with an invalid `request-target` 1.8%
• CVE-2025-31486 Medium 5.3 Vite allows server.fs.deny to be bypassed with .svg or relative paths 40.5%
• CVE-2025-30208 Medium 5.3 Vite bypasses server.fs.deny when using `?raw??` 74.8%
• CVE-2025-24010 Medium 6.5 Vite allows any websites to send any requests to the development server and read the response 0.3%
• CVE-2024-45812 Medium 6.4 DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite 0.6%
• CVE-2024-45811 Medium 4.8 server.fs.deny bypassed when using ?import&raw in vite 1.1%
• CVE-2024-31207 Medium 5.9 Vite's `server.fs.deny` did not deny requests for patterns with directories 0.7%
• CVE-2024-23331 High 7.5 Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem 0.8%
• CVE-2023-49293 Medium 6.1 Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite 1.0%
• CVE-2023-34092 High 7.5 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) 3.2%