Skip to main content
cve.nowby Sazabi
← npm
npmPackage

vite

29 known vulnerabilities (7 high, 18 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
8.3.6 (Nov 5, 2026): no advisory affects it
Newest unaffected release
8.3.6 (Nov 5, 2026), the latest release
Advisories
29 · 7 high, 18 medium, 3 low
Weekly downloads
252M
Dependents
3,144
Releases
500+ since 2.7.3 (Dec 16, 2021)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-118662
    Affects 6.4.4 (6.4.5 is outside it)
  • CVE-2026-112947
    Affects 8.2.0 to 8.2.2 (8.2.4 is outside it); 8.3.0 to 8.3.2 (8.3.3 is outside it)
  • CVE-2026-112946
    Affects 2.7.3 to 6.4.3 (6.4.4 is outside it); 7.0.0 to 7.3.6 (7.3.7 is outside it); 8.0.0 to 8.1.5 (8.1.6 is outside it); 8.2.0 to 8.2.2 (8.2.4 is outside it); 8.3.0 to 8.3.2 (8.3.3 is outside it)
  • CVE-2026-112945
    Affects 2.7.3 to 6.4.3 (6.4.4 is outside it); 7.0.0 to 7.3.6 (7.3.7 is outside it); 8.0.0 to 8.1.5 (8.1.6 is outside it); 8.2.0 to 8.2.2 (8.2.4 is outside it); 8.3.0 to 8.3.2 (8.3.3 is outside it)
  • CVE-2026-112944
    Affects 2.7.3 to 6.4.3 (6.4.4 is outside it); 7.0.0 to 7.3.6 (7.3.7 is outside it); 8.0.0 to 8.1.5 (8.1.6 is outside it); 8.2.0 to 8.2.2 (8.2.4 is outside it); 8.3.0 to 8.3.2 (8.3.3 is outside it)
  • CVE-2026-112943
    Affects 2.7.3 to 6.4.3 (6.4.4 is outside it); 7.0.0 to 7.3.6 (7.3.7 is outside it); 8.0.0 to 8.1.5 (8.1.6 is outside it); 8.2.0 to 8.2.2 (8.2.4 is outside it); 8.3.0 to 8.3.2 (8.3.3 is outside it)
  • CVE-2026-112942
    Affects 2.7.3 to 6.4.3 (6.4.4 is outside it); 7.0.0 to 7.3.6 (7.3.7 is outside it); 8.0.0 to 8.1.5 (8.1.6 is outside it); 8.2.0 to 8.2.2 (8.2.4 is outside it); 8.3.0 to 8.3.2 (8.3.3 is outside it)
  • CVE-2026-53571
    Affects 2.7.3 to 6.4.2 (6.4.3 is outside it); 7.0.0 to 7.3.3 (7.3.5 is outside it); 8.0.0 to 8.0.15 (8.0.16 is outside it)
  • CVE-2026-53632
    Affects 2.7.3 to 6.4.2 (6.4.3 is outside it); 7.0.0 to 7.3.3 (7.3.5 is outside it); 8.0.0 to 8.0.15 (8.0.16 is outside it)
  • CVE-2024-52011
    Affects 2.7.3 to 5.4.8 (5.4.9 is outside it)
  • CVE-2026-39365
    Affects 2.7.3 to 6.4.1 (6.4.2 is outside it); 7.0.0 to 7.3.1 (7.3.2 is outside it); 8.0.0 to 8.0.4 (8.0.5 is outside it)
  • CVE-2026-39364
    Affects 7.1.0 to 7.3.1 (7.3.2 is outside it); 8.0.0 to 8.0.4 (8.0.5 is outside it)
Show all 29 advisoriesShow fewer advisories
  • CVE-2026-39363
    Affects 6.0.0 to 6.4.1 (6.4.2 is outside it); 7.0.0 to 7.3.1 (7.3.2 is outside it); 8.0.0 to 8.0.4 (8.0.5 is outside it)
  • CVE-2025-62522
    Affects 2.9.18 to 5.4.20 (5.4.21 is outside it); 6.0.0 to 6.4.0 (6.4.1 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it); 7.1.0 to 7.1.10 (7.1.11 is outside it)
  • CVE-2025-58752
    Affects 2.7.3 to 5.4.19 (5.4.20 is outside it); 6.0.0 to 6.3.5 (6.3.6 is outside it); 7.0.0 to 7.0.6 (7.0.7 is outside it); 7.1.0 to 7.1.4 (7.1.5 is outside it)
  • CVE-2025-58751
    Affects 2.7.3 to 5.4.19 (5.4.20 is outside it); 6.0.0 to 6.3.5 (6.3.6 is outside it); 7.0.0 to 7.0.6 (7.0.7 is outside it); 7.1.0 to 7.1.4 (7.1.5 is outside it)
  • CVE-2025-46565
    Affects 2.7.3 to 4.5.13 (4.5.14 is outside it); 5.0.0 to 5.4.18 (5.4.19 is outside it); 6.0.0 to 6.1.5 (6.1.6 is outside it); 6.2.0 to 6.2.6 (6.2.7 is outside it); 6.3.0 to 6.3.3 (6.3.4 is outside it)
  • CVE-2025-32395
    Affects 2.7.3 to 4.5.12 (4.5.13 is outside it); 5.0.0 to 5.4.17 (5.4.18 is outside it); 6.0.0 to 6.0.14 (6.0.15 is outside it); 6.1.0 to 6.1.4 (6.1.5 is outside it); 6.2.0 to 6.2.5 (6.2.6 is outside it)
  • CVE-2025-31486
    Affects 2.7.3 to 4.5.11 (4.5.12 is outside it); 5.0.0 to 5.4.16 (5.4.17 is outside it); 6.0.0 to 6.0.13 (6.0.14 is outside it); 6.1.0 to 6.1.3 (6.1.4 is outside it); 6.2.0 to 6.2.4 (6.2.5 is outside it)
  • CVE-2025-31125
    Affects 2.7.3 to 4.5.10 (4.5.11 is outside it); 5.0.0 to 5.4.15 (5.4.16 is outside it); 6.0.0 to 6.0.12 (6.0.13 is outside it); 6.1.0 to 6.1.2 (6.1.3 is outside it); 6.2.0 to 6.2.3 (6.2.4 is outside it)
  • CVE-2025-30208
    Affects 2.7.3 to 4.5.9 (4.5.10 is outside it); 5.0.0 to 5.4.14 (5.4.15 is outside it); 6.0.0 to 6.0.11 (6.0.12 is outside it); 6.1.0 to 6.1.1 (6.1.2 is outside it); 6.2.0 to 6.2.2 (6.2.3 is outside it)
  • CVE-2025-24010
    Affects 2.7.3 to 4.5.5 (4.5.6 is outside it); 5.0.0 to 5.4.11 (5.4.12 is outside it); 6.0.0 to 6.0.8 (6.0.9 is outside it)
  • CVE-2024-45812
    Affects 2.7.3 to 3.2.10 (3.2.11 is outside it); 4.0.0 to 4.5.3 (4.5.5 is outside it); 5.0.0 to 5.1.7 (5.1.8 is outside it); 5.2.0 to 5.2.13 (5.2.14 is outside it); 5.3.0 to 5.3.5 (5.3.6 is outside it); 5.4.0 to 5.4.5 (5.4.6 is outside it)
  • CVE-2024-45811
    Affects 2.7.3 to 3.2.10 (3.2.11 is outside it); 4.0.0 to 4.5.3 (4.5.5 is outside it); 5.0.0 to 5.1.7 (5.1.8 is outside it); 5.2.0 to 5.2.13 (5.2.14 is outside it); 5.3.0 to 5.3.5 (5.3.6 is outside it); 5.4.0 to 5.4.5 (5.4.6 is outside it)
  • CVE-2024-31207
    Affects 2.7.3 to 2.9.17 (2.9.18 is outside it); 3.0.0 to 3.2.8 (3.2.10 is outside it); 4.0.0 to 4.5.2 (4.5.3 is outside it); 5.0.0 to 5.0.12 (5.0.13 is outside it); 5.1.0 to 5.1.6 (5.1.7 is outside it); 5.2.0 to 5.2.5 (5.2.6 is outside it)
  • CVE-2024-23331
    Affects 2.7.3 to 2.9.16 (2.9.17 is outside it); 3.0.0 to 3.2.7 (3.2.8 is outside it); 4.0.0 to 4.5.1 (4.5.2 is outside it); 5.0.0 to 5.0.11 (5.0.12 is outside it)
  • CVE-2023-49293
    Affects 4.4.0 to 4.4.11 (4.4.12 is outside it); 4.5.0 (4.5.1 is outside it); 5.0.0 to 5.0.4 (5.0.5 is outside it)
  • CVE-2023-34092
    Affects 2.7.3 to 2.9.15 (2.9.16 is outside it); 3.0.2 to 3.2.6 (3.2.7 is outside it); 4.0.0 to 4.0.4 (4.0.5 is outside it); 4.1.0 to 4.1.4 (4.1.5 is outside it); 4.2.0 to 4.2.2 (4.2.3 is outside it); 4.3.0 to 4.3.8 (4.3.9 is outside it)
  • CVE-2022-35204
    Affects 2.7.3 to 2.9.12 (2.9.13 is outside it); 3.0.0-alpha.0 to 3.0.0-beta.3 (3.0.0-beta.4 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 29

  • CVE-2026-118662Medium 6.9

    Vite: `server.fs.deny` bypassed with queries

    Affected: from 6.4.4, fixed in 6.4.5.

    Fixed in 6.4.5 (released Oct 21, 2026, 7 days before disclosure).

    The latest release, 8.3.6, is not affected.

    1.2% of vite downloads last week were affected versions (3.4M).

  • CVE-2026-112947Medium 6.3

    Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

    Affected: from 8.3.0, fixed in 8.3.3; from 8.2.0, fixed in 8.2.4.

    Fixed in 8.2.4 (released Oct 6, 2026, 14 days before disclosure) and 8.3.3 (released Oct 6, 2026, 14 days before disclosure).

    The latest release, 8.3.6, is not affected.

    9.7% of vite downloads last week were affected versions (26.8M).

  • CVE-2026-112946Medium 6.3

    Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

    Affected: from 8.3.0, fixed in 8.3.3; from 8.2.0, fixed in 8.2.4; from 8.0.0, fixed in 8.1.6; from 7.0.0, fixed in 7.3.7; fixed in 6.4.4.

    Fixed in 6.4.4 (released Oct 6, 2026, 14 days before disclosure), 7.3.7 (released Oct 6, 2026, 14 days before disclosure), 8.1.6 (released Oct 6, 2026, 14 days before disclosure) and 2 other versions.

    The latest release, 8.3.6, is not affected.

    57% of vite downloads last week were affected versions (158.2M).

  • Vite: Cross origin script execution through Vite custom middleware

    Affected: from 8.3.0, fixed in 8.3.3; from 8.2.0, fixed in 8.2.4; from 8.0.0, fixed in 8.1.6; from 7.0.0, fixed in 7.3.7; fixed in 6.4.4.

    Fixed in 6.4.4 (released Oct 6, 2026, 14 days before disclosure), 7.3.7 (released Oct 6, 2026, 14 days before disclosure), 8.1.6 (released Oct 6, 2026, 14 days before disclosure) and 2 other versions.

    The latest release, 8.3.6, is not affected.

    57% of vite downloads last week were affected versions (158.2M).

  • CVE-2026-112944Medium 6.3

    launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

    Affected: from 8.3.0, fixed in 8.3.3; from 8.2.0, fixed in 8.2.4; from 8.0.0, fixed in 8.1.6; from 7.0.0, fixed in 7.3.7; fixed in 6.4.4.

    Fixed in 6.4.4 (released Oct 6, 2026, 14 days before disclosure), 7.3.7 (released Oct 6, 2026, 14 days before disclosure), 8.1.6 (released Oct 6, 2026, 14 days before disclosure) and 2 other versions.

    The latest release, 8.3.6, is not affected.

    57% of vite downloads last week were affected versions (158.2M).

  • CVE-2026-112943Medium 6.3

    launch-editor: escapeCmdArgs() omits % escaping on Windows

    Affected: from 8.3.0, fixed in 8.3.3; from 8.2.0, fixed in 8.2.4; from 8.0.0, fixed in 8.1.6; from 7.0.0, fixed in 7.3.7; fixed in 6.4.4.

    Fixed in 6.4.4 (released Oct 6, 2026, 14 days before disclosure), 7.3.7 (released Oct 6, 2026, 14 days before disclosure), 8.1.6 (released Oct 6, 2026, 14 days before disclosure) and 2 other versions.

    The latest release, 8.3.6, is not affected.

    57% of vite downloads last week were affected versions (158.2M).

  • launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

    Affected: from 8.3.0, fixed in 8.3.3; from 8.2.0, fixed in 8.2.4; from 8.0.0, fixed in 8.1.6; from 7.0.0, fixed in 7.3.7; fixed in 6.4.4.

    Fixed in 6.4.4 (released Oct 6, 2026, 14 days before disclosure), 7.3.7 (released Oct 6, 2026, 14 days before disclosure), 8.1.6 (released Oct 6, 2026, 14 days before disclosure) and 2 other versions.

    The latest release, 8.3.6, is not affected.

    57% of vite downloads last week were affected versions (158.2M).

  • Vite: `server.fs.deny` bypass on Windows alternate paths

    Affected: from 8.0.0, fixed in 8.0.16; from 7.0.0, fixed in 7.3.5; fixed in 6.4.3.

    Fixed in 6.4.3 (released Jun 1, 2026, 21 days before disclosure), 7.3.5 (released Jun 1, 2026, 21 days before disclosure) and 8.0.16 (released Jun 1, 2026, 21 days before disclosure).

    The latest release, 8.3.6, is not affected.

    31% of vite downloads last week were affected versions (85.6M).

  • CVE-2026-53632Medium 5.5

    NTLMv2 hash disclosure via UNC path handling on Windows

    Affected: from 8.0.0, fixed in 8.0.16; from 7.0.0, fixed in 7.3.5; fixed in 6.4.3.

    Fixed in 6.4.3 (released Jun 1, 2026, 21 days before disclosure), 7.3.5 (released Jun 1, 2026, 21 days before disclosure) and 8.0.16 (released Jun 1, 2026, 21 days before disclosure).

    The latest release, 8.3.6, is not affected.

    31% of vite downloads last week were affected versions (85.6M).

  • launch-editor vulnerable to command injection via the crafted request on Windows

    Affected: fixed in 5.4.9.

    Fixed in 5.4.9 (released Oct 14, 2024, 595 days before disclosure).

    The latest release, 8.3.6, is not affected.

    2.9% of vite downloads last week were affected versions (8.1M).

  • CVE-2026-39365Medium 6.3

    Vite has a Path Traversal in Optimized Deps `.map` Handling

    Affected: from 8.0.0, fixed in 8.0.5; from 7.0.0, fixed in 7.3.2; fixed in 6.4.2.

    Fixed in 6.4.2 (released Apr 6, 2026, 1 day before disclosure), 7.3.2 (released Apr 6, 2026, 1 day before disclosure) and 8.0.5 (released Apr 6, 2026, 1 day before disclosure).

    The latest release, 8.3.6, is not affected.

    25% of vite downloads last week were affected versions (68.2M).

  • Vite has a `server.fs.deny` bypass with queries

    Affected: from 8.0.0, fixed in 8.0.5; from 7.1.0, fixed in 7.3.2.

    Fixed in 7.3.2 (released Apr 6, 2026, 1 day before disclosure) and 8.0.5 (released Apr 6, 2026, 1 day before disclosure).

    The latest release, 8.3.6, is not affected.

    6% of vite downloads last week were affected versions (16.6M).

  • Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

    Affected: from 8.0.0, fixed in 8.0.5; from 7.0.0, fixed in 7.3.2; from 6.0.0, fixed in 6.4.2.

    Fixed in 6.4.2 (released Apr 6, 2026, 1 day before disclosure), 7.3.2 (released Apr 6, 2026, 1 day before disclosure) and 8.0.5 (released Apr 6, 2026, 1 day before disclosure).

    The latest release, 8.3.6, is not affected.

    11% of vite downloads last week were affected versions (30.9M).

  • CVE-2025-62522Medium 6.0

    vite allows server.fs.deny bypass via backslash on Windows

    Affected: from 7.1.0, fixed in 7.1.11; from 7.0.0, fixed in 7.0.8; from 6.0.0, fixed in 6.4.1; from 2.9.18, fixed in 5.4.21; from 3.2.9, fixed in 5.4.21; from 4.5.3, fixed in 5.4.21; from 5.2.6, fixed in 5.4.21.

    Fixed in 5.4.21 (released Oct 20, 2025, the day of disclosure), 6.4.1 (released Oct 20, 2025, the day of disclosure), 7.0.8 (released Oct 20, 2025, the day of disclosure) and 1 other version.

    The latest release, 8.3.6, is not affected.

    9.7% of vite downloads last week were affected versions (26.6M).

  • Vite's `server.fs` settings were not applied to HTML files

    Affected: from 7.1.0, fixed in 7.1.5; from 7.0.0, fixed in 7.0.7; from 6.0.0, fixed in 6.3.6; fixed in 5.4.20.

    Fixed in 5.4.20 (released Sep 8, 2025, the day of disclosure), 6.3.6 (released Sep 8, 2025, the day of disclosure), 7.0.7 (released Sep 8, 2025, the day of disclosure) and 1 other version.

    The latest release, 8.3.6, is not affected.

    7.8% of vite downloads last week were affected versions (21.6M).

Show all 29 advisoriesShow fewer advisories

  • Vite middleware may serve files starting with the same name with the public directory

    Affected: from 7.1.0, fixed in 7.1.5; from 7.0.0, fixed in 7.0.7; from 6.0.0, fixed in 6.3.6; fixed in 5.4.20.

    Fixed in 5.4.20 (released Sep 8, 2025, the day of disclosure), 6.3.6 (released Sep 8, 2025, the day of disclosure), 7.0.7 (released Sep 8, 2025, the day of disclosure) and 1 other version.

    The latest release, 8.3.6, is not affected.

    7.8% of vite downloads last week were affected versions (21.6M).

  • CVE-2025-46565Medium 6.0

    Vite's server.fs.deny bypassed with /. for files under project root

    Affected: from 6.3.0, fixed in 6.3.4; from 6.2.0, fixed in 6.2.7; from 6.0.0, fixed in 6.1.6; from 5.0.0, fixed in 5.4.19; fixed in 4.5.14.

    Fixed in 4.5.14 (released Apr 30, 2025, 1 day before disclosure), 5.4.19 (released Apr 30, 2025, 1 day before disclosure), 6.1.6 (released Apr 30, 2025, 1 day before disclosure) and 2 other versions.

    The latest release, 8.3.6, is not affected.

    4.3% of vite downloads last week were affected versions (11.9M).

  • CVE-2025-32395Medium 6.0

    Vite has an `server.fs.deny` bypass with an invalid `request-target`

    Affected: from 6.2.0, fixed in 6.2.6; from 6.1.0, fixed in 6.1.5; from 6.0.0, fixed in 6.0.15; from 5.0.0, fixed in 5.4.18; fixed in 4.5.13.

    Fixed in 4.5.13 (released Apr 10, 2025, the day of disclosure), 5.4.18 (released Apr 10, 2025, the day of disclosure), 6.0.15 (released Apr 10, 2025, the day of disclosure) and 2 other versions.

    The latest release, 8.3.6, is not affected.

    4.1% of vite downloads last week were affected versions (11.2M).

  • CVE-2025-31486Medium 5.3

    Vite allows server.fs.deny to be bypassed with .svg or relative paths

    Affected: from 6.2.0, fixed in 6.2.5; from 6.1.0, fixed in 6.1.4; from 6.0.0, fixed in 6.0.14; from 5.0.0, fixed in 5.4.17; fixed in 4.5.12.

    Fixed in 4.5.12 (released Apr 3, 2025, the day of disclosure), 5.4.17 (released Apr 3, 2025, the day of disclosure), 6.0.14 (released Apr 3, 2025, the day of disclosure) and 2 other versions.

    The latest release, 8.3.6, is not affected.

    4% of vite downloads last week were affected versions (10.9M).

  • CVE-2025-31125Medium 5.3 · KEV

    Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

    Affected: from 6.2.0, fixed in 6.2.4; from 6.1.0, fixed in 6.1.3; from 6.0.0, fixed in 6.0.13; from 5.0.0, fixed in 5.4.16; fixed in 4.5.11.

    Fixed in 4.5.11 (released Mar 31, 2025, the day of disclosure), 5.4.16 (released Mar 31, 2025, the day of disclosure), 6.0.13 (released Mar 31, 2025, the day of disclosure) and 2 other versions.

    The latest release, 8.3.6, is not affected.

    3.9% of vite downloads last week were affected versions (10.8M).

  • CVE-2025-30208Medium 5.3

    Vite bypasses server.fs.deny when using `?raw??`

    Affected: from 6.2.0, fixed in 6.2.3; from 6.1.0, fixed in 6.1.2; from 6.0.0, fixed in 6.0.12; from 5.0.0, fixed in 5.4.15; fixed in 4.5.10.

    Fixed in 4.5.10 (released Mar 24, 2025, the day of disclosure), 5.4.15 (released Mar 24, 2025, the day of disclosure), 6.0.12 (released Mar 24, 2025, the day of disclosure) and 2 other versions.

    The latest release, 8.3.6, is not affected.

    3.8% of vite downloads last week were affected versions (10.5M).

  • CVE-2025-24010Medium 6.5

    Vite allows any websites to send any requests to the development server and read the response

    Affected: from 6.0.0, fixed in 6.0.9; from 5.0.0, fixed in 5.4.12; fixed in 4.5.6.

    Fixed in 4.5.6 (released Jan 20, 2025, the day of disclosure), 5.4.12 (released Jan 20, 2025, the day of disclosure) and 6.0.9 (released Jan 20, 2025, the day of disclosure).

    The latest release, 8.3.6, is not affected.

    3.2% of vite downloads last week were affected versions (8.9M).

  • CVE-2024-45812Medium 6.4

    DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite

    Affected: from 5.4.0, fixed in 5.4.6; from 5.3.0, fixed in 5.3.6; from 5.2.0, fixed in 5.2.14; from 4.0.0, fixed in 4.5.4; fixed in 3.2.11; from 5.0.0, fixed in 5.1.8.

    Fixed in 3.2.11 (released Sep 17, 2024, the day of disclosure), 4.5.5 (released Sep 16, 2024, 1 day before disclosure, the advisory names 4.5.4, which was never published), 5.1.8 (released Sep 19, 2024, 2 days after disclosure) and 3 other versions.

    The latest release, 8.3.6, is not affected.

    1.8% of vite downloads last week were affected versions (4.9M).

  • CVE-2024-45811Medium 4.8

    server.fs.deny bypassed when using ?import&raw in vite

    Affected: from 5.4.0, fixed in 5.4.6; from 5.3.0, fixed in 5.3.6; from 5.2.0, fixed in 5.2.14; from 4.0.0, fixed in 4.5.4; fixed in 3.2.11; from 5.0.0, fixed in 5.1.8.

    Fixed in 3.2.11 (released Sep 17, 2024, the day of disclosure), 4.5.5 (released Sep 16, 2024, 1 day before disclosure, the advisory names 4.5.4, which was never published), 5.1.8 (released Sep 19, 2024, 2 days after disclosure) and 3 other versions.

    The latest release, 8.3.6, is not affected.

    1.8% of vite downloads last week were affected versions (4.9M).

  • CVE-2024-31207Medium 5.9

    Vite's `server.fs.deny` did not deny requests for patterns with directories

    Affected: from 2.7.0, fixed in 2.9.18; from 3.0.0, fixed in 3.2.10; from 4.0.0, fixed in 4.5.3; from 5.0.0, fixed in 5.0.13; from 5.1.0, fixed in 5.1.7; from 5.2.0, fixed in 5.2.6.

    Fixed in 2.9.18 (released Mar 24, 2024, 11 days before disclosure), 3.2.10 (released Mar 24, 2024, 11 days before disclosure), 4.5.3 (released Mar 24, 2024, 11 days before disclosure) and 3 other versions.

    The latest release, 8.3.6, is not affected.

    1.2% of vite downloads last week were affected versions (3.2M).

  • Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

    Affected: from 2.7.0, fixed in 2.9.17; from 3.0.0, fixed in 3.2.8; from 4.0.0, fixed in 4.5.2; from 5.0.0, fixed in 5.0.12.

    Fixed in 2.9.17 (released Jan 19, 2024, the day of disclosure), 3.2.8 (released Jan 19, 2024, the day of disclosure), 4.5.2 (released Jan 19, 2024, the day of disclosure) and 1 other version.

    The latest release, 8.3.6, is not affected.

    0.5% of vite downloads last week were affected versions (1.4M).

  • CVE-2023-49293Medium 6.1

    Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite

    Affected: from 4.4.0, fixed in 4.4.12; from 4.5.0, fixed in 4.5.1; from 5.0.0, fixed in 5.0.5.

    Fixed in 4.4.12 (released Dec 4, 2023, the day of disclosure), 4.5.1 (released Dec 4, 2023, the day of disclosure) and 5.0.5 (released Dec 4, 2023, the day of disclosure).

    The latest release, 8.3.6, is not affected.

    0.2% of vite downloads last week were affected versions (478.9K).

  • Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

    Affected: fixed in 2.9.16; from 3.0.2, fixed in 3.2.7; from 4.0.0, fixed in 4.0.5; from 4.1.0, fixed in 4.1.5; from 4.2.0, fixed in 4.2.3; from 4.3.0, fixed in 4.3.9.

    Fixed in 2.9.16 (released May 26, 2023, 6 days before disclosure), 3.2.7 (released May 26, 2023, 6 days before disclosure), 4.0.5 (released May 26, 2023, 6 days before disclosure) and 3 other versions.

    The latest release, 8.3.6, is not affected.

    0.2% of vite downloads last week were affected versions (508.5K).

  • Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service.

    Affected: fixed in 2.9.13; from 3.0.0-alpha.0, fixed in 3.0.0-beta.4.

    Fixed in 2.9.13 (released Jun 27, 2022, 52 days before disclosure) and 3.0.0-beta.4 (released Jun 27, 2022, 52 days before disclosure).

    The latest release, 8.3.6, is not affected.

    <0.1% of vite downloads last week were affected versions (94.1K).