npm

vite-plus

Security advisories for vite-plus, newest first. 8 known, all fixed. If you’re on 1.1.0 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

1.4.0

Advisories

8 · 0 unfixed

Last advisory

21 Oct 2026

Safe from

1.1.0

8 advisories · newest first

LOW 21 Oct 2026

Vite: Cross origin script execution through Vite custom middleware

GHSA-9jrq-w75r-8gcw · CVE-2026-112945

Affected

< 1.1.0

Fixed in

1.1.0

Published

21 Oct 2026

MODERATE 21 Oct 2026

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

GHSA-rq7h-c2jc-7f22 · CVE-2026-112946

Affected

< 1.1.0

Fixed in

1.1.0

Published

21 Oct 2026

MODERATE 21 Oct 2026

Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

GHSA-vfpm-58rq-9qcg · CVE-2026-112947

Affected

≥ 0.2.8, < 1.1.0

Fixed in

1.1.0

Published

21 Oct 2026

MODERATE 20 Oct 2026

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

GHSA-r825-w8mm-5pxw · CVE-2026-112944

Affected

< 1.1.0

Fixed in

1.1.0

Published

20 Oct 2026

HIGH 20 Oct 2026

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

GHSA-587h-7wmj-h5pm · CVE-2026-112942

Affected

< 1.1.0

Fixed in

1.1.0

Published

20 Oct 2026

MODERATE 20 Oct 2026

launch-editor: escapeCmdArgs() omits % escaping on Windows

GHSA-698v-4r3x-3vcv · CVE-2026-112943

Affected

< 1.1.0

Fixed in

1.1.0

Published

20 Oct 2026

MODERATE 15 Jun 2026

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

GHSA-v6wh-96g9-6wx3 · CVE-2026-53632

Affected

< 0.1.24

Fixed in

0.1.24

Published

15 Jun 2026

HIGH7.5 15 Jun 2026

vite: `server.fs.deny` bypass on Windows alternate paths

GHSA-fx2h-pf6j-xcff · CVE-2026-53571

Affected

< 0.1.24

Fixed in

0.1.24

Published

15 Jun 2026

/advisories/npm/vite-plus/feed.rss

From the GitHub advisory database, via OSV · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →