# vite (npm) vulnerabilities 29 known vulnerabilities (7 high, 18 medium, 3 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 8.3.6 (Nov 5, 2026): no advisory affects it - Newest unaffected release: 8.3.6 (Nov 5, 2026), the latest release - Weekly downloads: 252M - Dependents: 3,144 - Releases: 500+ since 2.7.3 (Dec 16, 2021) - Registry: https://www.npmjs.com/package/vite - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-118662: 6.4.4 (6.4.5 is outside it) - CVE-2026-112947: 8.2.0 to 8.2.2 (8.2.4 is outside it); 8.3.0 to 8.3.2 (8.3.3 is outside it) - CVE-2026-112946: 2.7.3 to 6.4.3 (6.4.4 is outside it); 7.0.0 to 7.3.6 (7.3.7 is outside it); 8.0.0 to 8.1.5 (8.1.6 is outside it); 8.2.0 to 8.2.2 (8.2.4 is outside it); 8.3.0 to 8.3.2 (8.3.3 is outside it) - CVE-2026-112945: 2.7.3 to 6.4.3 (6.4.4 is outside it); 7.0.0 to 7.3.6 (7.3.7 is outside it); 8.0.0 to 8.1.5 (8.1.6 is outside it); 8.2.0 to 8.2.2 (8.2.4 is outside it); 8.3.0 to 8.3.2 (8.3.3 is outside it) - CVE-2026-112944: 2.7.3 to 6.4.3 (6.4.4 is outside it); 7.0.0 to 7.3.6 (7.3.7 is outside it); 8.0.0 to 8.1.5 (8.1.6 is outside it); 8.2.0 to 8.2.2 (8.2.4 is outside it); 8.3.0 to 8.3.2 (8.3.3 is outside it) - CVE-2026-112943: 2.7.3 to 6.4.3 (6.4.4 is outside it); 7.0.0 to 7.3.6 (7.3.7 is outside it); 8.0.0 to 8.1.5 (8.1.6 is outside it); 8.2.0 to 8.2.2 (8.2.4 is outside it); 8.3.0 to 8.3.2 (8.3.3 is outside it) - CVE-2026-112942: 2.7.3 to 6.4.3 (6.4.4 is outside it); 7.0.0 to 7.3.6 (7.3.7 is outside it); 8.0.0 to 8.1.5 (8.1.6 is outside it); 8.2.0 to 8.2.2 (8.2.4 is outside it); 8.3.0 to 8.3.2 (8.3.3 is outside it) - CVE-2026-53571: 2.7.3 to 6.4.2 (6.4.3 is outside it); 7.0.0 to 7.3.3 (7.3.5 is outside it); 8.0.0 to 8.0.15 (8.0.16 is outside it) - CVE-2026-53632: 2.7.3 to 6.4.2 (6.4.3 is outside it); 7.0.0 to 7.3.3 (7.3.5 is outside it); 8.0.0 to 8.0.15 (8.0.16 is outside it) - CVE-2024-52011: 2.7.3 to 5.4.8 (5.4.9 is outside it) - CVE-2026-39365: 2.7.3 to 6.4.1 (6.4.2 is outside it); 7.0.0 to 7.3.1 (7.3.2 is outside it); 8.0.0 to 8.0.4 (8.0.5 is outside it) - CVE-2026-39364: 7.1.0 to 7.3.1 (7.3.2 is outside it); 8.0.0 to 8.0.4 (8.0.5 is outside it) - CVE-2026-39363: 6.0.0 to 6.4.1 (6.4.2 is outside it); 7.0.0 to 7.3.1 (7.3.2 is outside it); 8.0.0 to 8.0.4 (8.0.5 is outside it) - CVE-2025-62522: 2.9.18 to 5.4.20 (5.4.21 is outside it); 6.0.0 to 6.4.0 (6.4.1 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it); 7.1.0 to 7.1.10 (7.1.11 is outside it) - CVE-2025-58752: 2.7.3 to 5.4.19 (5.4.20 is outside it); 6.0.0 to 6.3.5 (6.3.6 is outside it); 7.0.0 to 7.0.6 (7.0.7 is outside it); 7.1.0 to 7.1.4 (7.1.5 is outside it) - CVE-2025-58751: 2.7.3 to 5.4.19 (5.4.20 is outside it); 6.0.0 to 6.3.5 (6.3.6 is outside it); 7.0.0 to 7.0.6 (7.0.7 is outside it); 7.1.0 to 7.1.4 (7.1.5 is outside it) - CVE-2025-46565: 2.7.3 to 4.5.13 (4.5.14 is outside it); 5.0.0 to 5.4.18 (5.4.19 is outside it); 6.0.0 to 6.1.5 (6.1.6 is outside it); 6.2.0 to 6.2.6 (6.2.7 is outside it); 6.3.0 to 6.3.3 (6.3.4 is outside it) - CVE-2025-32395: 2.7.3 to 4.5.12 (4.5.13 is outside it); 5.0.0 to 5.4.17 (5.4.18 is outside it); 6.0.0 to 6.0.14 (6.0.15 is outside it); 6.1.0 to 6.1.4 (6.1.5 is outside it); 6.2.0 to 6.2.5 (6.2.6 is outside it) - CVE-2025-31486: 2.7.3 to 4.5.11 (4.5.12 is outside it); 5.0.0 to 5.4.16 (5.4.17 is outside it); 6.0.0 to 6.0.13 (6.0.14 is outside it); 6.1.0 to 6.1.3 (6.1.4 is outside it); 6.2.0 to 6.2.4 (6.2.5 is outside it) - CVE-2025-31125: 2.7.3 to 4.5.10 (4.5.11 is outside it); 5.0.0 to 5.4.15 (5.4.16 is outside it); 6.0.0 to 6.0.12 (6.0.13 is outside it); 6.1.0 to 6.1.2 (6.1.3 is outside it); 6.2.0 to 6.2.3 (6.2.4 is outside it) - CVE-2025-30208: 2.7.3 to 4.5.9 (4.5.10 is outside it); 5.0.0 to 5.4.14 (5.4.15 is outside it); 6.0.0 to 6.0.11 (6.0.12 is outside it); 6.1.0 to 6.1.1 (6.1.2 is outside it); 6.2.0 to 6.2.2 (6.2.3 is outside it) - CVE-2025-24010: 2.7.3 to 4.5.5 (4.5.6 is outside it); 5.0.0 to 5.4.11 (5.4.12 is outside it); 6.0.0 to 6.0.8 (6.0.9 is outside it) - CVE-2024-45812: 2.7.3 to 3.2.10 (3.2.11 is outside it); 4.0.0 to 4.5.3 (4.5.5 is outside it); 5.0.0 to 5.1.7 (5.1.8 is outside it); 5.2.0 to 5.2.13 (5.2.14 is outside it); 5.3.0 to 5.3.5 (5.3.6 is outside it); 5.4.0 to 5.4.5 (5.4.6 is outside it) - CVE-2024-45811: 2.7.3 to 3.2.10 (3.2.11 is outside it); 4.0.0 to 4.5.3 (4.5.5 is outside it); 5.0.0 to 5.1.7 (5.1.8 is outside it); 5.2.0 to 5.2.13 (5.2.14 is outside it); 5.3.0 to 5.3.5 (5.3.6 is outside it); 5.4.0 to 5.4.5 (5.4.6 is outside it) - CVE-2024-31207: 2.7.3 to 2.9.17 (2.9.18 is outside it); 3.0.0 to 3.2.8 (3.2.10 is outside it); 4.0.0 to 4.5.2 (4.5.3 is outside it); 5.0.0 to 5.0.12 (5.0.13 is outside it); 5.1.0 to 5.1.6 (5.1.7 is outside it); 5.2.0 to 5.2.5 (5.2.6 is outside it) - CVE-2024-23331: 2.7.3 to 2.9.16 (2.9.17 is outside it); 3.0.0 to 3.2.7 (3.2.8 is outside it); 4.0.0 to 4.5.1 (4.5.2 is outside it); 5.0.0 to 5.0.11 (5.0.12 is outside it) - CVE-2023-49293: 4.4.0 to 4.4.11 (4.4.12 is outside it); 4.5.0 (4.5.1 is outside it); 5.0.0 to 5.0.4 (5.0.5 is outside it) - CVE-2023-34092: 2.7.3 to 2.9.15 (2.9.16 is outside it); 3.0.2 to 3.2.6 (3.2.7 is outside it); 4.0.0 to 4.0.4 (4.0.5 is outside it); 4.1.0 to 4.1.4 (4.1.5 is outside it); 4.2.0 to 4.2.2 (4.2.3 is outside it); 4.3.0 to 4.3.8 (4.3.9 is outside it) - CVE-2022-35204: 2.7.3 to 2.9.12 (2.9.13 is outside it); 3.0.0-alpha.0 to 3.0.0-beta.3 (3.0.0-beta.4 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (29) ### [CVE-2026-118662](https://cve.now/CVE-2026-118662): Vite: \`server.fs.deny\` bypassed with queries - Severity: Medium 6.9 - Published: Oct 28, 2026 - Affected: from 6.4.4, fixed in 6.4.5. - Fixed in 6.4.5 (released Oct 21, 2026, 7 days before disclosure). - The latest release, 8.3.6, is not affected. - 1.2% of vite downloads last week were affected versions (3.4M). ### [CVE-2026-112947](https://cve.now/CVE-2026-112947): Vite: First 4 bytes of files outside of \`server.fs\` setting is exposed by \`?vite-wasm-instance\` - Severity: Medium 6.3 - Published: Oct 20, 2026 - Affected: from 8.3.0, fixed in 8.3.3; from 8.2.0, fixed in 8.2.4. - Fixed in 8.2.4 (released Oct 6, 2026, 14 days before disclosure) and 8.3.3 (released Oct 6, 2026, 14 days before disclosure). - The latest release, 8.3.6, is not affected. - 9.7% of vite downloads last week were affected versions (26.8M). ### [CVE-2026-112946](https://cve.now/CVE-2026-112946): Vite: Files outside \`server.fs.allow\` could be served when project paths match system paths on non-Windows machine - Severity: Medium 6.3 - Published: Oct 20, 2026 - Affected: from 8.3.0, fixed in 8.3.3; from 8.2.0, fixed in 8.2.4; from 8.0.0, fixed in 8.1.6; from 7.0.0, fixed in 7.3.7; fixed in 6.4.4. - Fixed in 6.4.4 (released Oct 6, 2026, 14 days before disclosure), 7.3.7 (released Oct 6, 2026, 14 days before disclosure), 8.1.6 (released Oct 6, 2026, 14 days before disclosure) and 2 other versions. - The latest release, 8.3.6, is not affected. - 57% of vite downloads last week were affected versions (158.2M). ### [CVE-2026-112945](https://cve.now/CVE-2026-112945): Vite: Cross origin script execution through Vite custom middleware - Severity: Low 2.1 - Published: Oct 20, 2026 - Affected: from 8.3.0, fixed in 8.3.3; from 8.2.0, fixed in 8.2.4; from 8.0.0, fixed in 8.1.6; from 7.0.0, fixed in 7.3.7; fixed in 6.4.4. - Fixed in 6.4.4 (released Oct 6, 2026, 14 days before disclosure), 7.3.7 (released Oct 6, 2026, 14 days before disclosure), 8.1.6 (released Oct 6, 2026, 14 days before disclosure) and 2 other versions. - The latest release, 8.3.6, is not affected. - 57% of vite downloads last week were affected versions (158.2M). ### [CVE-2026-112944](https://cve.now/CVE-2026-112944): launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors - Severity: Medium 6.3 - Published: Oct 20, 2026 - Affected: from 8.3.0, fixed in 8.3.3; from 8.2.0, fixed in 8.2.4; from 8.0.0, fixed in 8.1.6; from 7.0.0, fixed in 7.3.7; fixed in 6.4.4. - Fixed in 6.4.4 (released Oct 6, 2026, 14 days before disclosure), 7.3.7 (released Oct 6, 2026, 14 days before disclosure), 8.1.6 (released Oct 6, 2026, 14 days before disclosure) and 2 other versions. - The latest release, 8.3.6, is not affected. - 57% of vite downloads last week were affected versions (158.2M). ### [CVE-2026-112943](https://cve.now/CVE-2026-112943): launch-editor: escapeCmdArgs() omits % escaping on Windows - Severity: Medium 6.3 - Published: Oct 20, 2026 - Affected: from 8.3.0, fixed in 8.3.3; from 8.2.0, fixed in 8.2.4; from 8.0.0, fixed in 8.1.6; from 7.0.0, fixed in 7.3.7; fixed in 6.4.4. - Fixed in 6.4.4 (released Oct 6, 2026, 14 days before disclosure), 7.3.7 (released Oct 6, 2026, 14 days before disclosure), 8.1.6 (released Oct 6, 2026, 14 days before disclosure) and 2 other versions. - The latest release, 8.3.6, is not affected. - 57% of vite downloads last week were affected versions (158.2M). ### [CVE-2026-112942](https://cve.now/CVE-2026-112942): launch-editor: \`fs.existsSync()\` existence check can be bypassed on Windows - Severity: High 7.5 - Published: Oct 20, 2026 - Affected: from 8.3.0, fixed in 8.3.3; from 8.2.0, fixed in 8.2.4; from 8.0.0, fixed in 8.1.6; from 7.0.0, fixed in 7.3.7; fixed in 6.4.4. - Fixed in 6.4.4 (released Oct 6, 2026, 14 days before disclosure), 7.3.7 (released Oct 6, 2026, 14 days before disclosure), 8.1.6 (released Oct 6, 2026, 14 days before disclosure) and 2 other versions. - The latest release, 8.3.6, is not affected. - 57% of vite downloads last week were affected versions (158.2M). ### [CVE-2026-53571](https://cve.now/CVE-2026-53571): Vite: \`server.fs.deny\` bypass on Windows alternate paths - Severity: High 8.2 - Published: Jun 22, 2026 - Affected: from 8.0.0, fixed in 8.0.16; from 7.0.0, fixed in 7.3.5; fixed in 6.4.3. - Fixed in 6.4.3 (released Jun 1, 2026, 21 days before disclosure), 7.3.5 (released Jun 1, 2026, 21 days before disclosure) and 8.0.16 (released Jun 1, 2026, 21 days before disclosure). - The latest release, 8.3.6, is not affected. - 31% of vite downloads last week were affected versions (85.6M). ### [CVE-2026-53632](https://cve.now/CVE-2026-53632): NTLMv2 hash disclosure via UNC path handling on Windows - Severity: Medium 5.5 - Published: Jun 22, 2026 - Affected: from 8.0.0, fixed in 8.0.16; from 7.0.0, fixed in 7.3.5; fixed in 6.4.3. - Fixed in 6.4.3 (released Jun 1, 2026, 21 days before disclosure), 7.3.5 (released Jun 1, 2026, 21 days before disclosure) and 8.0.16 (released Jun 1, 2026, 21 days before disclosure). - The latest release, 8.3.6, is not affected. - 31% of vite downloads last week were affected versions (85.6M). ### [CVE-2024-52011](https://cve.now/CVE-2024-52011): launch-editor vulnerable to command injection via the crafted request on Windows - Severity: High 7.5 - Published: Jun 1, 2026 - Affected: fixed in 5.4.9. - Fixed in 5.4.9 (released Oct 14, 2024, 595 days before disclosure). - The latest release, 8.3.6, is not affected. - 2.9% of vite downloads last week were affected versions (8.1M). ### [CVE-2026-39365](https://cve.now/CVE-2026-39365): Vite has a Path Traversal in Optimized Deps \`.map\` Handling - Severity: Medium 6.3 - Published: Apr 7, 2026 - Affected: from 8.0.0, fixed in 8.0.5; from 7.0.0, fixed in 7.3.2; fixed in 6.4.2. - Fixed in 6.4.2 (released Apr 6, 2026, 1 day before disclosure), 7.3.2 (released Apr 6, 2026, 1 day before disclosure) and 8.0.5 (released Apr 6, 2026, 1 day before disclosure). - The latest release, 8.3.6, is not affected. - 25% of vite downloads last week were affected versions (68.2M). ### [CVE-2026-39364](https://cve.now/CVE-2026-39364): Vite has a \`server.fs.deny\` bypass with queries - Severity: High 8.2 - Published: Apr 7, 2026 - Affected: from 8.0.0, fixed in 8.0.5; from 7.1.0, fixed in 7.3.2. - Fixed in 7.3.2 (released Apr 6, 2026, 1 day before disclosure) and 8.0.5 (released Apr 6, 2026, 1 day before disclosure). - The latest release, 8.3.6, is not affected. - 6% of vite downloads last week were affected versions (16.6M). ### [CVE-2026-39363](https://cve.now/CVE-2026-39363): Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket - Severity: High 8.2 - Published: Apr 7, 2026 - Affected: from 8.0.0, fixed in 8.0.5; from 7.0.0, fixed in 7.3.2; from 6.0.0, fixed in 6.4.2. - Fixed in 6.4.2 (released Apr 6, 2026, 1 day before disclosure), 7.3.2 (released Apr 6, 2026, 1 day before disclosure) and 8.0.5 (released Apr 6, 2026, 1 day before disclosure). - The latest release, 8.3.6, is not affected. - 11% of vite downloads last week were affected versions (30.9M). ### [CVE-2025-62522](https://cve.now/CVE-2025-62522): vite allows server.fs.deny bypass via backslash on Windows - Severity: Medium 6.0 - Published: Oct 20, 2025 - Affected: from 7.1.0, fixed in 7.1.11; from 7.0.0, fixed in 7.0.8; from 6.0.0, fixed in 6.4.1; from 2.9.18, fixed in 5.4.21; from 3.2.9, fixed in 5.4.21; from 4.5.3, fixed in 5.4.21; from 5.2.6, fixed in 5.4.21. - Fixed in 5.4.21 (released Oct 20, 2025, the day of disclosure), 6.4.1 (released Oct 20, 2025, the day of disclosure), 7.0.8 (released Oct 20, 2025, the day of disclosure) and 1 other version. - The latest release, 8.3.6, is not affected. - 9.7% of vite downloads last week were affected versions (26.6M). ### [CVE-2025-58752](https://cve.now/CVE-2025-58752): Vite's \`server.fs\` settings were not applied to HTML files - Severity: Low 2.3 - Published: Sep 8, 2025 - Affected: from 7.1.0, fixed in 7.1.5; from 7.0.0, fixed in 7.0.7; from 6.0.0, fixed in 6.3.6; fixed in 5.4.20. - Fixed in 5.4.20 (released Sep 8, 2025, the day of disclosure), 6.3.6 (released Sep 8, 2025, the day of disclosure), 7.0.7 (released Sep 8, 2025, the day of disclosure) and 1 other version. - The latest release, 8.3.6, is not affected. - 7.8% of vite downloads last week were affected versions (21.6M). ### [CVE-2025-58751](https://cve.now/CVE-2025-58751): Vite middleware may serve files starting with the same name with the public directory - Severity: Low 2.3 - Published: Sep 8, 2025 - Affected: from 7.1.0, fixed in 7.1.5; from 7.0.0, fixed in 7.0.7; from 6.0.0, fixed in 6.3.6; fixed in 5.4.20. - Fixed in 5.4.20 (released Sep 8, 2025, the day of disclosure), 6.3.6 (released Sep 8, 2025, the day of disclosure), 7.0.7 (released Sep 8, 2025, the day of disclosure) and 1 other version. - The latest release, 8.3.6, is not affected. - 7.8% of vite downloads last week were affected versions (21.6M). ### [CVE-2025-46565](https://cve.now/CVE-2025-46565): Vite's server.fs.deny bypassed with /. for files under project root - Severity: Medium 6.0 - Published: May 1, 2025 - Affected: from 6.3.0, fixed in 6.3.4; from 6.2.0, fixed in 6.2.7; from 6.0.0, fixed in 6.1.6; from 5.0.0, fixed in 5.4.19; fixed in 4.5.14. - Fixed in 4.5.14 (released Apr 30, 2025, 1 day before disclosure), 5.4.19 (released Apr 30, 2025, 1 day before disclosure), 6.1.6 (released Apr 30, 2025, 1 day before disclosure) and 2 other versions. - The latest release, 8.3.6, is not affected. - 4.3% of vite downloads last week were affected versions (11.9M). ### [CVE-2025-32395](https://cve.now/CVE-2025-32395): Vite has an \`server.fs.deny\` bypass with an invalid \`request-target\` - Severity: Medium 6.0 - Published: Apr 10, 2025 - Affected: from 6.2.0, fixed in 6.2.6; from 6.1.0, fixed in 6.1.5; from 6.0.0, fixed in 6.0.15; from 5.0.0, fixed in 5.4.18; fixed in 4.5.13. - Fixed in 4.5.13 (released Apr 10, 2025, the day of disclosure), 5.4.18 (released Apr 10, 2025, the day of disclosure), 6.0.15 (released Apr 10, 2025, the day of disclosure) and 2 other versions. - The latest release, 8.3.6, is not affected. - 4.1% of vite downloads last week were affected versions (11.2M). ### [CVE-2025-31486](https://cve.now/CVE-2025-31486): Vite allows server.fs.deny to be bypassed with .svg or relative paths - Severity: Medium 5.3 - Published: Apr 3, 2025 - Affected: from 6.2.0, fixed in 6.2.5; from 6.1.0, fixed in 6.1.4; from 6.0.0, fixed in 6.0.14; from 5.0.0, fixed in 5.4.17; fixed in 4.5.12. - Fixed in 4.5.12 (released Apr 3, 2025, the day of disclosure), 5.4.17 (released Apr 3, 2025, the day of disclosure), 6.0.14 (released Apr 3, 2025, the day of disclosure) and 2 other versions. - The latest release, 8.3.6, is not affected. - 4% of vite downloads last week were affected versions (10.9M). ### [CVE-2025-31125](https://cve.now/CVE-2025-31125): Vite has a \`server.fs.deny\` bypassed for \`inline\` and \`raw\` with \`?import\` query - Severity: Medium 5.3 ยท KEV - Published: Mar 31, 2025 - Affected: from 6.2.0, fixed in 6.2.4; from 6.1.0, fixed in 6.1.3; from 6.0.0, fixed in 6.0.13; from 5.0.0, fixed in 5.4.16; fixed in 4.5.11. - Fixed in 4.5.11 (released Mar 31, 2025, the day of disclosure), 5.4.16 (released Mar 31, 2025, the day of disclosure), 6.0.13 (released Mar 31, 2025, the day of disclosure) and 2 other versions. - The latest release, 8.3.6, is not affected. - 3.9% of vite downloads last week were affected versions (10.8M). ### [CVE-2025-30208](https://cve.now/CVE-2025-30208): Vite bypasses server.fs.deny when using \`?raw??\` - Severity: Medium 5.3 - Published: Mar 24, 2025 - Affected: from 6.2.0, fixed in 6.2.3; from 6.1.0, fixed in 6.1.2; from 6.0.0, fixed in 6.0.12; from 5.0.0, fixed in 5.4.15; fixed in 4.5.10. - Fixed in 4.5.10 (released Mar 24, 2025, the day of disclosure), 5.4.15 (released Mar 24, 2025, the day of disclosure), 6.0.12 (released Mar 24, 2025, the day of disclosure) and 2 other versions. - The latest release, 8.3.6, is not affected. - 3.8% of vite downloads last week were affected versions (10.5M). ### [CVE-2025-24010](https://cve.now/CVE-2025-24010): Vite allows any websites to send any requests to the development server and read the response - Severity: Medium 6.5 - Published: Jan 20, 2025 - Affected: from 6.0.0, fixed in 6.0.9; from 5.0.0, fixed in 5.4.12; fixed in 4.5.6. - Fixed in 4.5.6 (released Jan 20, 2025, the day of disclosure), 5.4.12 (released Jan 20, 2025, the day of disclosure) and 6.0.9 (released Jan 20, 2025, the day of disclosure). - The latest release, 8.3.6, is not affected. - 3.2% of vite downloads last week were affected versions (8.9M). ### [CVE-2024-45812](https://cve.now/CVE-2024-45812): DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite - Severity: Medium 6.4 - Published: Sep 17, 2024 - Affected: from 5.4.0, fixed in 5.4.6; from 5.3.0, fixed in 5.3.6; from 5.2.0, fixed in 5.2.14; from 4.0.0, fixed in 4.5.4; fixed in 3.2.11; from 5.0.0, fixed in 5.1.8. - Fixed in 3.2.11 (released Sep 17, 2024, the day of disclosure), 4.5.5 (released Sep 16, 2024, 1 day before disclosure, the advisory names 4.5.4, which was never published), 5.1.8 (released Sep 19, 2024, 2 days after disclosure) and 3 other versions. - The latest release, 8.3.6, is not affected. - 1.8% of vite downloads last week were affected versions (4.9M). ### [CVE-2024-45811](https://cve.now/CVE-2024-45811): server.fs.deny bypassed when using ?import&raw in vite - Severity: Medium 4.8 - Published: Sep 17, 2024 - Affected: from 5.4.0, fixed in 5.4.6; from 5.3.0, fixed in 5.3.6; from 5.2.0, fixed in 5.2.14; from 4.0.0, fixed in 4.5.4; fixed in 3.2.11; from 5.0.0, fixed in 5.1.8. - Fixed in 3.2.11 (released Sep 17, 2024, the day of disclosure), 4.5.5 (released Sep 16, 2024, 1 day before disclosure, the advisory names 4.5.4, which was never published), 5.1.8 (released Sep 19, 2024, 2 days after disclosure) and 3 other versions. - The latest release, 8.3.6, is not affected. - 1.8% of vite downloads last week were affected versions (4.9M). ### [CVE-2024-31207](https://cve.now/CVE-2024-31207): Vite's \`server.fs.deny\` did not deny requests for patterns with directories - Severity: Medium 5.9 - Published: Apr 4, 2024 - Affected: from 2.7.0, fixed in 2.9.18; from 3.0.0, fixed in 3.2.10; from 4.0.0, fixed in 4.5.3; from 5.0.0, fixed in 5.0.13; from 5.1.0, fixed in 5.1.7; from 5.2.0, fixed in 5.2.6. - Fixed in 2.9.18 (released Mar 24, 2024, 11 days before disclosure), 3.2.10 (released Mar 24, 2024, 11 days before disclosure), 4.5.3 (released Mar 24, 2024, 11 days before disclosure) and 3 other versions. - The latest release, 8.3.6, is not affected. - 1.2% of vite downloads last week were affected versions (3.2M). ### [CVE-2024-23331](https://cve.now/CVE-2024-23331): Vite dev server option \`server.fs.deny\` can be bypassed when hosted on case-insensitive filesystem - Severity: High 7.5 - Published: Jan 19, 2024 - Affected: from 2.7.0, fixed in 2.9.17; from 3.0.0, fixed in 3.2.8; from 4.0.0, fixed in 4.5.2; from 5.0.0, fixed in 5.0.12. - Fixed in 2.9.17 (released Jan 19, 2024, the day of disclosure), 3.2.8 (released Jan 19, 2024, the day of disclosure), 4.5.2 (released Jan 19, 2024, the day of disclosure) and 1 other version. - The latest release, 8.3.6, is not affected. - 0.5% of vite downloads last week were affected versions (1.4M). ### [CVE-2023-49293](https://cve.now/CVE-2023-49293): Cross-site Scripting in \`server.transformIndexHtml\` via URL payload in vite - Severity: Medium 6.1 - Published: Dec 4, 2023 - Affected: from 4.4.0, fixed in 4.4.12; from 4.5.0, fixed in 4.5.1; from 5.0.0, fixed in 5.0.5. - Fixed in 4.4.12 (released Dec 4, 2023, the day of disclosure), 4.5.1 (released Dec 4, 2023, the day of disclosure) and 5.0.5 (released Dec 4, 2023, the day of disclosure). - The latest release, 8.3.6, is not affected. - 0.2% of vite downloads last week were affected versions (478.9K). ### [CVE-2023-34092](https://cve.now/CVE-2023-34092): Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) - Severity: High 7.5 - Published: Jun 1, 2023 - Affected: fixed in 2.9.16; from 3.0.2, fixed in 3.2.7; from 4.0.0, fixed in 4.0.5; from 4.1.0, fixed in 4.1.5; from 4.2.0, fixed in 4.2.3; from 4.3.0, fixed in 4.3.9. - Fixed in 2.9.16 (released May 26, 2023, 6 days before disclosure), 3.2.7 (released May 26, 2023, 6 days before disclosure), 4.0.5 (released May 26, 2023, 6 days before disclosure) and 3 other versions. - The latest release, 8.3.6, is not affected. - 0.2% of vite downloads last week were affected versions (508.5K). ### [CVE-2022-35204](https://cve.now/CVE-2022-35204): Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service. - Severity: Unrated - Published: Aug 18, 2022 - Affected: fixed in 2.9.13; from 3.0.0-alpha.0, fixed in 3.0.0-beta.4. - Fixed in 2.9.13 (released Jun 27, 2022, 52 days before disclosure) and 3.0.0-beta.4 (released Jun 27, 2022, 52 days before disclosure). - The latest release, 8.3.6, is not affected. - <0.1% of vite downloads last week were affected versions (94.1K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/vite Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.