vitejs vite-plus

• CVE-2026-112948 Medium 6.5 Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file 0.4%
• CVE-2026-112947 Medium 6.3 Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` 0.5%
• CVE-2026-112946 Medium 6.3 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine 0.9%
• CVE-2026-112945 Low 2.1 Vite: Cross origin script execution through Vite custom middleware 0.7%
• CVE-2026-112944 Medium 6.3 launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors 0.7%
• CVE-2026-112943 Medium 6.3 launch-editor: escapeCmdArgs() omits % escaping on Windows 0.4%
• CVE-2026-112942 High 7.5 launch-editor: `fs.existsSync()` existence check can be bypassed on Windows 1.3%
• CVE-2026-53632 Medium 5.5 NTLMv2 hash disclosure via UNC path handling on Windows 0.4%
• CVE-2026-39365 Medium 6.3 Vite has a Path Traversal in Optimized Deps `.map` Handling 0.9%
• CVE-2026-39364 High 7.5 Vite has a `server.fs.deny` bypass with queries 2.3%
• CVE-2026-39363 High 7.5 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket 3.4%