npmPackage

vite-plus

11 known vulnerabilities (1 critical, 3 high, 6 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: 1.5.0 (Nov 4, 2026): no advisory affects it
Newest unaffected release: 1.5.0 (Nov 4, 2026), the latest release
Advisories: 11 · 1 critical, 3 high, 6 medium, 1 low

Weekly downloads: 4.3M
Dependents: 12
Releases: 155 since 0.0.1 (Jan 30, 2022)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-112948
Affects 1.0.0-rc.0 to 1.2.0 (1.3.0 is outside it)
CVE-2026-112947
Affects 0.2.8 to 1.0.0 (1.1.0 is outside it)
CVE-2026-112946
Affects 0.0.0-0bfcc90f.20260209-0731 to 1.0.0 (1.1.0 is outside it)
CVE-2026-112945
Affects 0.0.0-0bfcc90f.20260209-0731 to 1.0.0 (1.1.0 is outside it)
CVE-2026-112944
Affects 0.0.0-0bfcc90f.20260209-0731 to 1.0.0 (1.1.0 is outside it)
CVE-2026-112943
Affects 0.0.0-0bfcc90f.20260209-0731 to 1.0.0 (1.1.0 is outside it)
CVE-2026-112942
Affects 0.0.0-0bfcc90f.20260209-0731 to 1.0.0 (1.1.0 is outside it)
CVE-2026-53633
Affects 0.0.0-0bfcc90f.20260209-0731 to 0.1.23 (0.1.24 is outside it)
CVE-2026-53571
Affects 0.0.0-0bfcc90f.20260209-0731 to 0.1.23 (0.1.24 is outside it)
CVE-2026-53632
Affects 0.0.0-0bfcc90f.20260209-0731 to 0.1.23 (0.1.24 is outside it)
CVE-2026-41211
Affects 0.0.0-0bfcc90f.20260209-0731 to 0.1.17-alpha.5 (0.1.17 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 11

CVE-2026-112948Medium 6.5
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
Affected: from 1.0.0-rc.0, fixed in 1.3.0.
Fixed in 1.3.0 (released Oct 16, 2026, 4 days before disclosure).
The latest release, 1.5.0, is not affected.
15% of vite-plus downloads last week were affected versions (718.6K).
CVE-2026-112947Medium 6.3
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Affected: from 0.2.8, fixed in 1.1.0.
Fixed in 1.1.0 (released Oct 7, 2026, 13 days before disclosure).
The latest release, 1.5.0, is not affected.
22% of vite-plus downloads last week were affected versions (1.1M).
CVE-2026-112946Medium 6.3
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
Affected: fixed in 1.1.0.
Fixed in 1.1.0 (released Oct 7, 2026, 13 days before disclosure).
The latest release, 1.5.0, is not affected.
29% of vite-plus downloads last week were affected versions (1.4M).
CVE-2026-112945Low 2.1
Vite: Cross origin script execution through Vite custom middleware
Affected: fixed in 1.1.0.
Fixed in 1.1.0 (released Oct 7, 2026, 13 days before disclosure).
The latest release, 1.5.0, is not affected.
29% of vite-plus downloads last week were affected versions (1.4M).
CVE-2026-112944Medium 6.3
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
Affected: fixed in 1.1.0.
Fixed in 1.1.0 (released Oct 7, 2026, 13 days before disclosure).
The latest release, 1.5.0, is not affected.
29% of vite-plus downloads last week were affected versions (1.4M).
CVE-2026-112943Medium 6.3
launch-editor: escapeCmdArgs() omits % escaping on Windows
Affected: fixed in 1.1.0.
Fixed in 1.1.0 (released Oct 7, 2026, 13 days before disclosure).
The latest release, 1.5.0, is not affected.
29% of vite-plus downloads last week were affected versions (1.4M).
CVE-2026-112942High 7.5
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
Affected: fixed in 1.1.0.
Fixed in 1.1.0 (released Oct 7, 2026, 13 days before disclosure).
The latest release, 1.5.0, is not affected.
29% of vite-plus downloads last week were affected versions (1.4M).
CVE-2026-53633Critical 9.8
Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Affected: fixed in 0.1.24.
Fixed in 0.1.24 (released Jun 1, 2026, 43 days before disclosure).
The latest release, 1.5.0, is not affected.
1% of vite-plus downloads last week were affected versions (50.9K).
CVE-2026-53571High 8.2
Vite: `server.fs.deny` bypass on Windows alternate paths
Affected: fixed in 0.1.24.
Fixed in 0.1.24 (released Jun 1, 2026, 21 days before disclosure).
The latest release, 1.5.0, is not affected.
1% of vite-plus downloads last week were affected versions (50.9K).
CVE-2026-53632Medium 5.5
NTLMv2 hash disclosure via UNC path handling on Windows
Affected: fixed in 0.1.24.
Fixed in 0.1.24 (released Jun 1, 2026, 21 days before disclosure).
The latest release, 1.5.0, is not affected.
1% of vite-plus downloads last week were affected versions (50.9K).
CVE-2026-41211High 8.4
`vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME`
Affected: fixed in 0.1.17.
Fixed in 0.1.17 (released Apr 15, 2026, 8 days before disclosure).
The latest release, 1.5.0, is not affected.
0.4% of vite-plus downloads last week were affected versions (17.5K).