Vitejs vulnerabilities
31 CVEs and advisories name Vitejs as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-118662Vite: `server.fs.deny` bypassed with queries
- CVE-2026-112948Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
- CVE-2026-112947Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
- CVE-2026-112946Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
- CVE-2026-112945Vite: Cross origin script execution through Vite custom middleware
- CVE-2026-112944launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
- CVE-2026-112943launch-editor: escapeCmdArgs() omits % escaping on Windows
- CVE-2026-112942launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
- CVE-2026-53571Vite: `server.fs.deny` bypass on Windows alternate paths
- CVE-2026-53632NTLMv2 hash disclosure via UNC path handling on Windows
- CVE-2024-52011launch-editor vulnerable to command injection via the crafted request on Windows
- CVE-2026-39365Vite has a Path Traversal in Optimized Deps `.map` Handling
- CVE-2026-39364Vite has a `server.fs.deny` bypass with queries
- CVE-2026-39363Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket
- CVE-2025-68155@vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development
- CVE-2025-67489@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server
- CVE-2025-62522vite allows server.fs.deny bypass via backslash on Windows
- CVE-2025-58752Vite's `server.fs` settings were not applied to HTML files
- CVE-2025-58751Vite middleware may serve files starting with the same name with the public directory
- CVE-2025-46565Vite's server.fs.deny bypassed with /. for files under project root
- CVE-2025-32395Vite has an `server.fs.deny` bypass with an invalid `request-target`
- CVE-2025-31486Vite allows server.fs.deny to be bypassed with .svg or relative paths
- CVE-2025-31125Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
- CVE-2025-30208Vite bypasses server.fs.deny when using `?raw??`
- CVE-2025-24010Vite allows any websites to send any requests to the development server and read the response
- CVE-2024-45812DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite
- CVE-2024-45811server.fs.deny bypassed when using ?import&raw in vite
- CVE-2024-31207Vite's `server.fs.deny` did not deny requests for patterns with directories
- CVE-2024-23331Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
- CVE-2023-49293Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite