# cve.now: Vitejs

The newest entries naming Vitejs as an affected vendor (up to 200), of 31 in all, 1 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-118662](https://cve.now/CVE-2026-118662.md): Vite: \`server.fs.deny\` bypassed with queries (CVSS 6.9)
- [CVE-2026-112948](https://cve.now/CVE-2026-112948.md): Vitest: Servers misapply \`server.fs.deny\`, serving \`.env\`, private keys, \`.git\`, and the API token file (CVSS 6.5)
- [CVE-2026-112947](https://cve.now/CVE-2026-112947.md): Vite: First 4 bytes of files outside of \`server.fs\` setting is exposed by \`?vite-wasm-instance\` (CVSS 6.3)
- [CVE-2026-112946](https://cve.now/CVE-2026-112946.md): Vite: Files outside \`server.fs.allow\` could be served when project paths match system paths on non-Windows machine (CVSS 6.3)
- [CVE-2026-112945](https://cve.now/CVE-2026-112945.md): Vite: Cross origin script execution through Vite custom middleware (CVSS 2.1)
- [CVE-2026-112944](https://cve.now/CVE-2026-112944.md): launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors (CVSS 6.3)
- [CVE-2026-112943](https://cve.now/CVE-2026-112943.md): launch-editor: escapeCmdArgs() omits % escaping on Windows (CVSS 6.3)
- [CVE-2026-112942](https://cve.now/CVE-2026-112942.md): launch-editor: \`fs.existsSync()\` existence check can be bypassed on Windows (CVSS 7.5)
- [CVE-2026-53571](https://cve.now/CVE-2026-53571.md): Vite: \`server.fs.deny\` bypass on Windows alternate paths (CVSS 8.2)
- [CVE-2026-53632](https://cve.now/CVE-2026-53632.md): NTLMv2 hash disclosure via UNC path handling on Windows (CVSS 5.5)
- [CVE-2024-52011](https://cve.now/CVE-2024-52011.md): launch-editor vulnerable to command injection via the crafted request on Windows (CVSS 7.5)
- [CVE-2026-39365](https://cve.now/CVE-2026-39365.md): Vite has a Path Traversal in Optimized Deps \`.map\` Handling (CVSS 6.3)
- [CVE-2026-39364](https://cve.now/CVE-2026-39364.md): Vite has a \`server.fs.deny\` bypass with queries (CVSS 8.2)
- [CVE-2026-39363](https://cve.now/CVE-2026-39363.md): Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket (CVSS 8.2)
- [CVE-2025-68155](https://cve.now/CVE-2025-68155.md): @vitejs/plugin-rsc has Arbitrary File Read via \`/\_\_vite\_rsc\_findSourceMapURL\` Endpoint on Development (CVSS 7.5)
- [CVE-2025-67489](https://cve.now/CVE-2025-67489.md): @vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server (CVSS 9.8)
- [CVE-2025-62522](https://cve.now/CVE-2025-62522.md): vite allows server.fs.deny bypass via backslash on Windows (CVSS 6.0)
- [CVE-2025-58752](https://cve.now/CVE-2025-58752.md): Vite's \`server.fs\` settings were not applied to HTML files (CVSS 2.3)
- [CVE-2025-58751](https://cve.now/CVE-2025-58751.md): Vite middleware may serve files starting with the same name with the public directory (CVSS 2.3)
- [CVE-2025-46565](https://cve.now/CVE-2025-46565.md): Vite's server.fs.deny bypassed with /. for files under project root (CVSS 6.0)
- [CVE-2025-32395](https://cve.now/CVE-2025-32395.md): Vite has an \`server.fs.deny\` bypass with an invalid \`request-target\` (CVSS 6.0)
- [CVE-2025-31486](https://cve.now/CVE-2025-31486.md): Vite allows server.fs.deny to be bypassed with .svg or relative paths (CVSS 5.3)
- [CVE-2025-31125](https://cve.now/CVE-2025-31125.md): Vite has a \`server.fs.deny\` bypassed for \`inline\` and \`raw\` with \`?import\` query (CVSS 5.3, KEV)
- [CVE-2025-30208](https://cve.now/CVE-2025-30208.md): Vite bypasses server.fs.deny when using \`?raw??\` (CVSS 5.3)
- [CVE-2025-24010](https://cve.now/CVE-2025-24010.md): Vite allows any websites to send any requests to the development server and read the response (CVSS 6.5)
- [CVE-2024-45812](https://cve.now/CVE-2024-45812.md): DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite (CVSS 6.4)
- [CVE-2024-45811](https://cve.now/CVE-2024-45811.md): server.fs.deny bypassed when using ?import&raw in vite (CVSS 4.8)
- [CVE-2024-31207](https://cve.now/CVE-2024-31207.md): Vite's \`server.fs.deny\` did not deny requests for patterns with directories (CVSS 5.9)
- [CVE-2024-23331](https://cve.now/CVE-2024-23331.md): Vite dev server option \`server.fs.deny\` can be bypassed when hosted on case-insensitive filesystem (CVSS 7.5)
- [CVE-2023-49293](https://cve.now/CVE-2023-49293.md): Cross-site Scripting in \`server.transformIndexHtml\` via URL payload in vite (CVSS 6.1)
- [CVE-2023-34092](https://cve.now/CVE-2023-34092.md): Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/vitejs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.