Security
فارسی
All products

vite-plus

npm · Package
11 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
vite: `server.fs.deny` bypass on Windows alternate pathsCVE-2026-53571 · GHSA-FX2H-PF6J-XCFF vite-plusvite npm Medium Fix reported
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token fileCVE-2026-112948 · GHSA-P458-7748-MCP3 @vitest/browser@vitest/ui npmRed Hat Medium Fix reported
Vite: Cross origin script execution through Vite custom middlewareCVE-2026-112945 · GHSA-9JRQ-W75R-8GCW vite-plusvite npmRed Hat Low Fix reported
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`CVE-2026-112947 · GHSA-VFPM-58RQ-9QCG vite-plusvite npmRed Hat Medium Fix reported
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machineCVE-2026-112946 · GHSA-RQ7H-C2JC-7F22 vite-plusvite npmRed Hat Medium Fix reported
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editorsCVE-2026-112944 · GHSA-R825-W8MM-5PXW launch-editorvite-plus npm Medium Fix reported
launch-editor: `fs.existsSync()` existence check can be bypassed on WindowsCVE-2026-112942 · GHSA-587H-7WMJ-H5PM launch-editorvite-plus npm High Fix reported
launch-editor: escapeCmdArgs() omits % escaping on WindowsCVE-2026-112943 · GHSA-698V-4R3X-3VCV launch-editorvite-plus npm Medium Fix reported
launch-editor: NTLMv2 hash disclosure via UNC path handling on WindowsCVE-2026-53632 · GHSA-V6WH-96G9-6WX3 launch-editorvite-plus npmRed Hat Medium Fix reported
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCECVE-2026-53633 · GHSA-G8MR-85JM-7XHM @vitest/browservite-plus npm Critical Fix reported
Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOMECVE-2026-41211 · GHSA-33R3-4WHC-44C2 vite-plus npm High Fix reported