vite-plus vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-112948Medium@vitest/ui: Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file CVE-2026-112945Lowvite: Vite: Cross origin script execution through Vite custom middleware CVE-2026-112946Mediumvite: Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine CVE-2026-112947Mediumvite: Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`CVE-2026-112944Mediumlaunch-editor: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors CVE-2026-112942Highlaunch-editor: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows CVE-2026-112943Mediumlaunch-editor: launch-editor: escapeCmdArgs() omits % escaping on Windows CVE-2026-53633Critical@vitest/browser: Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE CVE-2026-53632Mediumlaunch-editor: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows CVE-2026-53571Mediumvite: vite: `server.fs.deny` bypass on Windows alternate paths CVE-2026-41211Highvite-plus: Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo