VI
Vendor
vitejs
47
CVEs
1
On KEV
17
New 30D
Products
VI8.3
vite
vitejs
29 CVEs1 on KEV7 new
VI7.5
vite-plus
vitejs
11 CVEs0 on KEV7 new
LA8.3
launch-editor
vitejs
5 CVEs0 on KEV3 new
VI9.8
vite-plugin-react
vitejs
2 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118662 New | VI vite vitejs | 6.9 | Oct 28 | Vite: `server.fs.deny` bypassed with queries |
| CVE-2026-112948 | VI vite-plus vitejs | 6.5 | Oct 20 | Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file |
| CVE-2026-112947 | VI vite vitejs | 6.3 | Oct 20 | Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` |
| CVE-2026-112946 | VI vite vitejs | 6.3 | Oct 20 | Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine |
| CVE-2026-112945 | VI vite-plus vitejs | 2.1 | Oct 20 | Vite: Cross origin script execution through Vite custom middleware |
| CVE-2026-112944 | VI vite vitejs | 6.3 | Oct 20 | launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors |
| CVE-2026-112943 | LA launch-editor vitejs | 6.3 | Oct 20 | launch-editor: escapeCmdArgs() omits % escaping on Windows |
| CVE-2026-112942 | VI vite vitejs | 7.5 | Oct 20 | launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
| CVE-2026-53571 | VI vite vitejs | 7.5 | Jun 22 | Vite: `server.fs.deny` bypass on Windows alternate paths |
| CVE-2026-53632 | VI vite-plus vitejs | 5.5 | Jun 22 | NTLMv2 hash disclosure via UNC path handling on Windows |
| CVE-2024-52011 | LA launch-editor vitejs | 8.3 | Jun 1 | launch-editor vulnerable to command injection via the crafted request on Windows |
| CVE-2026-39365 | VI vite vitejs | 5.3 | Apr 7 | Vite has a Path Traversal in Optimized Deps `.map` Handling |
| CVE-2026-39364 | VI vite vitejs | 7.5 | Apr 7 | Vite has a `server.fs.deny` bypass with queries |
| CVE-2026-39363 | VI vite-plus vitejs | 7.5 | Apr 7 | Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket |
| CVE-2025-68155 | VI vite-plugin-react vitejs | 7.5 | Dec 16 | @vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development |
| CVE-2025-67489 | VI vite-plugin-react vitejs | 9.8 | Dec 9 | @vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server |
| CVE-2025-62522 | VI vite vitejs | 6.0 | Oct 20 | vite allows server.fs.deny bypass via backslash on Windows |
| CVE-2025-58752 | VI vite vitejs | 5.3 | Sep 8 | Vite's `server.fs` settings were not applied to HTML files |
| CVE-2025-58751 | VI vite vitejs | 5.3 | Sep 8 | Vite middleware may serve files starting with the same name with the public directory |
| CVE-2025-46565 | VI vite vitejs | 5.3 | May 1 | Vite's server.fs.deny bypassed with /. for files under project root |
| CVE-2025-32395 | VI vite vitejs | 6.0 | Apr 10 | Vite has an `server.fs.deny` bypass with an invalid `request-target` |
| CVE-2025-31486 | VI vite vitejs | 5.3 | Apr 3 | Vite allows server.fs.deny to be bypassed with .svg or relative paths |
| CVE-2025-31125 In wildKEV | VI vite vitejs | 7.5 | Mar 31 | Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query |
| CVE-2025-30208 | VI vite vitejs | 7.5 | Mar 24 | Vite bypasses server.fs.deny when using `?raw??` |
| CVE-2025-24010 | VI vite vitejs | 6.5 | Jan 20 | Vite allows any websites to send any requests to the development server and read the response |
| CVE-2024-45812 | VI vite vitejs | 6.4 | Sep 17 | DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite |
| CVE-2024-45811 | VI vite vitejs | 4.8 | Sep 17 | server.fs.deny bypassed when using ?import&raw in vite |
| CVE-2024-31207 | VI vite vitejs | 5.9 | Apr 4 | Vite's `server.fs.deny` did not deny requests for patterns with directories |
| CVE-2024-23331 | VI vite vitejs | 7.5 | Jan 19 | Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem |
| CVE-2023-49293 | VI vite vitejs | 6.1 | Dec 4 | Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite |
| CVE-2023-34092 | VI Vite Vitejs | 7.5 | Jun 1 | Vite provides frontend tooling |
| CVE-2022-35204 | VI Vite Vitejs | 4.3 | Aug 18 | Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service |