VI
Product
vite
On CISA KEVExploited in the wild
28
CVEs
1
On KEV
8.3
Max CVSS
7
New 30D
Severity mix
Critical 0High 9Medium 18Low 1
Watch
Add vite to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-118662 New | 6.9 | Oct 28 | Vite: `server.fs.deny` bypassed with queries Affected: >= 6.4.4, < 6.4.5 |
| CVE-2025-24010 | 6.5 | Jan 20 | Vite allows any websites to send any requests to the development server and read the response Affected: >= 6.0.0, < 6.0.9; >= 5.0.0, < 5.4.12; < 4.5.6 |
| CVE-2024-45812 | 6.4 | Sep 17 | DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite Affected: >= 5.4.0, < 5.4.6; >= 5.3.0, < 5.3.6; >= 5.0.0, < 5.2.14; >= 4.0.0, < 4.5.5; < 3.2.11 |
| CVE-2026-112947 | 6.3 | Oct 20 | Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` Affected: >= 8.3.0, < 8.3.3; >= 8.2.0, < 8.2.4 |
| CVE-2026-112946 | 6.3 | Oct 20 | Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine Affected: >= 8.3.0, < 8.3.3; >= 8.2.0, < 8.2.4; >= 8.0.0, < 8.1.6; >= 7.0.0, < 7.3.7; < 6.4.4 |
| CVE-2026-112944 | 6.3 | Oct 20 | launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors Affected: >= 8.3.0, < 8.3.3; >= 8.2.0, < 8.2.4; >= 8.0.0, < 8.1.6; >= 7.0.0, < 7.3.7; < 6.4.4 |
| CVE-2026-112943 | 6.3 | Oct 20 | launch-editor: escapeCmdArgs() omits % escaping on Windows Affected: >= 8.3.0, < 8.3.3; >= 8.2.0, < 8.2.4; >= 8.0.0, < 8.1.6; >= 7.0.0, < 7.3.7; < 6.4.4 |
| CVE-2023-49293 | 6.1 | Dec 4 | Vite is a website frontend framework Affected: 4.4.0 through 4.4.11; 5.0.0 through 5.0.4; 5.0.0; 5.0.0; 5.0.0; 5.0.0; +18 more |
| CVE-2025-62522 | 6.0 | Oct 20 | vite allows server.fs.deny bypass via backslash on Windows Affected: >= 7.1.0, < 7.1.11; >= 7.0.0, < 7.0.8; >= 6.0.0, < 6.4.1; >= 5.2.6, < 5.4.21; >= 4.5.3, < 5.0.0; >= 3.2.9, < 4.0.0; +1 more |
| CVE-2025-32395 | 6.0 | Apr 10 | Vite has an `server.fs.deny` bypass with an invalid `request-target` Affected: >= 6.2.0, < 6.2.6; >= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.15; >= 5.0.0, < 5.4.18; < 4.5.13 |
| CVE-2026-53632 | 5.5 | Jun 22 | NTLMv2 hash disclosure via UNC path handling on Windows Affected: >= 8.0.0, < 8.0.16; >= 7.0.0, < 7.3.5; < 6.4.3 |
| CVE-2026-39365 | 5.3 | Apr 7 | Vite has a Path Traversal in Optimized Deps `.map` Handling Affected: >= 8.0.0, < 8.0.5; >= 7.0.0, < 7.3.2; >= 6.0.0, < 6.4.2 |
| CVE-2025-58752 | 5.3 | Sep 8 | Vite's `server.fs` settings were not applied to HTML files Affected: < 5.4.20; >= 6.0.0, < 6.3.6; >= 7.0.0, < 7.0.7; >= 7.1.0, < 7.1.5 |
| CVE-2025-58751 | 5.3 | Sep 8 | Vite middleware may serve files starting with the same name with the public directory Affected: < 5.4.20; >= 6.0.0, < 6.3.6; >= 7.0.0, < 7.0.7; >= 7.1.0, < 7.1.5 |
| CVE-2025-46565 | 5.3 | May 1 | Vite's server.fs.deny bypassed with /. for files under project root Affected: >= 6.3.0, < 6.3.4; >= 6.2.0, < 6.2.7; >= 6.0.0, < 6.1.6; >= 5.0.0, < 5.4.19; < 4.5.14 |
| CVE-2025-31486 | 5.3 | Apr 3 | Vite allows server.fs.deny to be bypassed with .svg or relative paths Affected: < 4.5.12; >=5.0.0, < 5.4.17; >=6.0.0, < 6.0.14; >=6.1.0, < 6.1.4; >=6.2.0, < 6.2.5 |
| CVE-2024-45811 | 4.8 | Sep 17 | server.fs.deny bypassed when using ?import&raw in vite Affected: >= 5.4.0, < 5.4.6; >= 5.3.0, < 5.3.6; >= 5.0.0, < 5.2.14; >= 4.0.0, < 4.5.5; < 3.2.11 |
| CVE-2022-35204 | 4.3 | Aug 18 | Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service Affected: before 2.9.13 |
Showing 18