# vite-plus (npm) vulnerabilities 11 known vulnerabilities (1 critical, 3 high, 6 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.5.0 (Nov 4, 2026): no advisory affects it - Newest unaffected release: 1.5.0 (Nov 4, 2026), the latest release - Weekly downloads: 4.3M - Dependents: 12 - Releases: 155 since 0.0.1 (Jan 30, 2022) - Registry: https://www.npmjs.com/package/vite-plus - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-112948: 1.0.0-rc.0 to 1.2.0 (1.3.0 is outside it) - CVE-2026-112947: 0.2.8 to 1.0.0 (1.1.0 is outside it) - CVE-2026-112946: 0.0.0-0bfcc90f.20260209-0731 to 1.0.0 (1.1.0 is outside it) - CVE-2026-112945: 0.0.0-0bfcc90f.20260209-0731 to 1.0.0 (1.1.0 is outside it) - CVE-2026-112944: 0.0.0-0bfcc90f.20260209-0731 to 1.0.0 (1.1.0 is outside it) - CVE-2026-112943: 0.0.0-0bfcc90f.20260209-0731 to 1.0.0 (1.1.0 is outside it) - CVE-2026-112942: 0.0.0-0bfcc90f.20260209-0731 to 1.0.0 (1.1.0 is outside it) - CVE-2026-53633: 0.0.0-0bfcc90f.20260209-0731 to 0.1.23 (0.1.24 is outside it) - CVE-2026-53571: 0.0.0-0bfcc90f.20260209-0731 to 0.1.23 (0.1.24 is outside it) - CVE-2026-53632: 0.0.0-0bfcc90f.20260209-0731 to 0.1.23 (0.1.24 is outside it) - CVE-2026-41211: 0.0.0-0bfcc90f.20260209-0731 to 0.1.17-alpha.5 (0.1.17 is outside it) ## Advisories (11) ### [CVE-2026-112948](https://cve.now/CVE-2026-112948): Vitest: Servers misapply \`server.fs.deny\`, serving \`.env\`, private keys, \`.git\`, and the API token file - Severity: Medium 6.5 - Published: Oct 20, 2026 - Affected: from 1.0.0-rc.0, fixed in 1.3.0. - Fixed in 1.3.0 (released Oct 16, 2026, 4 days before disclosure). - The latest release, 1.5.0, is not affected. - 15% of vite-plus downloads last week were affected versions (718.6K). ### [CVE-2026-112947](https://cve.now/CVE-2026-112947): Vite: First 4 bytes of files outside of \`server.fs\` setting is exposed by \`?vite-wasm-instance\` - Severity: Medium 6.3 - Published: Oct 20, 2026 - Affected: from 0.2.8, fixed in 1.1.0. - Fixed in 1.1.0 (released Oct 7, 2026, 13 days before disclosure). - The latest release, 1.5.0, is not affected. - 22% of vite-plus downloads last week were affected versions (1.1M). ### [CVE-2026-112946](https://cve.now/CVE-2026-112946): Vite: Files outside \`server.fs.allow\` could be served when project paths match system paths on non-Windows machine - Severity: Medium 6.3 - Published: Oct 20, 2026 - Affected: fixed in 1.1.0. - Fixed in 1.1.0 (released Oct 7, 2026, 13 days before disclosure). - The latest release, 1.5.0, is not affected. - 29% of vite-plus downloads last week were affected versions (1.4M). ### [CVE-2026-112945](https://cve.now/CVE-2026-112945): Vite: Cross origin script execution through Vite custom middleware - Severity: Low 2.1 - Published: Oct 20, 2026 - Affected: fixed in 1.1.0. - Fixed in 1.1.0 (released Oct 7, 2026, 13 days before disclosure). - The latest release, 1.5.0, is not affected. - 29% of vite-plus downloads last week were affected versions (1.4M). ### [CVE-2026-112944](https://cve.now/CVE-2026-112944): launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors - Severity: Medium 6.3 - Published: Oct 20, 2026 - Affected: fixed in 1.1.0. - Fixed in 1.1.0 (released Oct 7, 2026, 13 days before disclosure). - The latest release, 1.5.0, is not affected. - 29% of vite-plus downloads last week were affected versions (1.4M). ### [CVE-2026-112943](https://cve.now/CVE-2026-112943): launch-editor: escapeCmdArgs() omits % escaping on Windows - Severity: Medium 6.3 - Published: Oct 20, 2026 - Affected: fixed in 1.1.0. - Fixed in 1.1.0 (released Oct 7, 2026, 13 days before disclosure). - The latest release, 1.5.0, is not affected. - 29% of vite-plus downloads last week were affected versions (1.4M). ### [CVE-2026-112942](https://cve.now/CVE-2026-112942): launch-editor: \`fs.existsSync()\` existence check can be bypassed on Windows - Severity: High 7.5 - Published: Oct 20, 2026 - Affected: fixed in 1.1.0. - Fixed in 1.1.0 (released Oct 7, 2026, 13 days before disclosure). - The latest release, 1.5.0, is not affected. - 29% of vite-plus downloads last week were affected versions (1.4M). ### [CVE-2026-53633](https://cve.now/CVE-2026-53633): Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE - Severity: Critical 9.8 - Published: Jul 14, 2026 - Affected: fixed in 0.1.24. - Fixed in 0.1.24 (released Jun 1, 2026, 43 days before disclosure). - The latest release, 1.5.0, is not affected. - 1% of vite-plus downloads last week were affected versions (50.9K). ### [CVE-2026-53571](https://cve.now/CVE-2026-53571): Vite: \`server.fs.deny\` bypass on Windows alternate paths - Severity: High 8.2 - Published: Jun 22, 2026 - Affected: fixed in 0.1.24. - Fixed in 0.1.24 (released Jun 1, 2026, 21 days before disclosure). - The latest release, 1.5.0, is not affected. - 1% of vite-plus downloads last week were affected versions (50.9K). ### [CVE-2026-53632](https://cve.now/CVE-2026-53632): NTLMv2 hash disclosure via UNC path handling on Windows - Severity: Medium 5.5 - Published: Jun 22, 2026 - Affected: fixed in 0.1.24. - Fixed in 0.1.24 (released Jun 1, 2026, 21 days before disclosure). - The latest release, 1.5.0, is not affected. - 1% of vite-plus downloads last week were affected versions (50.9K). ### [CVE-2026-41211](https://cve.now/CVE-2026-41211): \`vite-plus/binding\` has path traversal \`downloadPackageManager()\` that leads to writes outside of \`VP\_HOME\` - Severity: High 8.4 - Published: Apr 23, 2026 - Affected: fixed in 0.1.17. - Fixed in 0.1.17 (released Apr 15, 2026, 8 days before disclosure). - The latest release, 1.5.0, is not affected. - 0.4% of vite-plus downloads last week were affected versions (17.5K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/vite-plus Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.