npm

vite

Security advisories for vite, newest first. 13 known, all fixed. If you’re on 8.3.3 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

8.3.5

Advisories

13 · 0 unfixed

Last advisory

21 Oct 2026

Safe from

8.3.3

13 advisories · newest first

LOW 21 Oct 2026

Vite: Cross origin script execution through Vite custom middleware

GHSA-9jrq-w75r-8gcw · CVE-2026-112945

Affected

≥ 8.2.0, < 8.2.4 ≥ 8.3.0, < 8.3.3

Fixed in

8.2.4 8.3.3

Published

21 Oct 2026

MODERATE 21 Oct 2026

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

GHSA-rq7h-c2jc-7f22 · CVE-2026-112946

Affected

≥ 8.2.0, < 8.2.4 ≥ 8.3.0, < 8.3.3

Fixed in

8.2.4 8.3.3

Published

21 Oct 2026

MODERATE 21 Oct 2026

Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

GHSA-vfpm-58rq-9qcg · CVE-2026-112947

Affected

≥ 8.2.0, < 8.2.4 ≥ 8.3.0, < 8.3.3

Fixed in

8.2.4 8.3.3

Published

21 Oct 2026

MODERATE 20 Oct 2026

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

GHSA-r825-w8mm-5pxw · CVE-2026-112944

Affected

≥ 8.3.0, < 8.3.3

Fixed in

8.3.3

Published

20 Oct 2026

HIGH 20 Oct 2026

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

GHSA-587h-7wmj-h5pm · CVE-2026-112942

Affected

≥ 8.3.0, < 8.3.3

Fixed in

8.3.3

Published

20 Oct 2026

MODERATE 20 Oct 2026

launch-editor: escapeCmdArgs() omits % escaping on Windows

GHSA-698v-4r3x-3vcv · CVE-2026-112943

Affected

≥ 8.3.0, < 8.3.3

Fixed in

8.3.3

Published

20 Oct 2026

MODERATE 15 Jun 2026

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

GHSA-v6wh-96g9-6wx3 · CVE-2026-53632

Affected

≥ 8.0.0, < 8.0.16

Fixed in

8.0.16

Published

15 Jun 2026

HIGH7.5 15 Jun 2026

vite: `server.fs.deny` bypass on Windows alternate paths

GHSA-fx2h-pf6j-xcff · CVE-2026-53571

Affected

≥ 7.0.0, < 7.3.5 ≥ 8.0.0, < 8.0.16

Fixed in

7.3.5 8.0.16

Published

15 Jun 2026

MODERATE 6 Apr 2026

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

GHSA-4w7w-66w2-5vf9 · CVE-2026-39365

Affected

≥ 7.0.0, < 7.3.2 ≥ 8.0.0, < 8.0.5

Fixed in

7.3.2 8.0.5

Published

6 Apr 2026

HIGH 6 Apr 2026

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

GHSA-p9ff-h696-f583 · CVE-2026-39363

Affected

≥ 7.0.0, < 7.3.2 ≥ 8.0.0, < 8.0.5

Fixed in

7.3.2 8.0.5

Published

6 Apr 2026

MODERATE 20 Oct 2025

vite allows server.fs.deny bypass via backslash on Windows

GHSA-93m4-6634-74q7 · CVE-2025-62522

Affected

≥ 7.0.0, < 7.0.8 ≥ 7.1.0, < 7.1.11

Fixed in

7.0.8 7.1.11

Published

20 Oct 2025

LOW 9 Sep 2025

Vite middleware may serve files starting with the same name with the public directory

GHSA-g4jq-h2w9-997c · CVE-2025-58751

Affected

≥ 7.0.0, < 7.0.7 ≥ 7.1.0, < 7.1.5

Fixed in

7.0.7 7.1.5

Published

9 Sep 2025

LOW 9 Sep 2025

Vite's `server.fs` settings were not applied to HTML files

GHSA-jqfw-vq24-v9c3 · CVE-2025-58752

Affected

≥ 7.0.0, < 7.0.7 ≥ 7.1.0, < 7.1.5

Fixed in

7.0.7 7.1.5

Published

9 Sep 2025

/advisories/npm/vite/feed.rss

From the GitHub advisory database, via OSV · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →