What’s Vulnerable › Products
vitejs vite vulnerabilities
28 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 21 published in the last 12 months.
Check whether your vitejs vite version is affected
Exploited vitejs vite vulnerabilities
- CVE-2025-31125 — Vite Vitejs Improper Access Control Vulnerability
Latest vitejs vite vulnerabilities
- CVE-2026-112947 — Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` (CVSS 6.3)
- CVE-2026-112946 — Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine (CVSS 6.3)
- CVE-2026-112945 — Vite: Cross origin script execution through Vite custom middleware (CVSS 2.1)
- CVE-2026-112944 — launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors (CVSS 6.3)
- CVE-2026-112943 — launch-editor: escapeCmdArgs() omits % escaping on Windows (CVSS 6.3)
- CVE-2026-112942 — launch-editor: `fs.existsSync()` existence check can be bypassed on Windows (CVSS 7.5)
- CVE-2026-53632 — NTLMv2 hash disclosure via UNC path handling on Windows (CVSS 5.5)
- CVE-2026-53571 — Vite: `server.fs.deny` bypass on Windows alternate paths (CVSS 7.5)
- CVE-2024-52011 — launch-editor vulnerable to command injection via the crafted request on Windows (CVSS 8.3)
- CVE-2026-39365 — Vite has a Path Traversal in Optimized Deps `.map` Handling (CVSS 5.3)
- CVE-2026-39364 — Vite has a `server.fs.deny` bypass with queries (CVSS 7.5)
- CVE-2026-39363 — Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket (CVSS 7.5)
- CVE-2025-62522 — vite allows server.fs.deny bypass via backslash on Windows (CVSS 6.0)
- CVE-2025-58752 — Vite's `server.fs` settings were not applied to HTML files (CVSS 5.3)
- CVE-2025-58751 — Vite middleware may serve files starting with the same name with the public directory (CVSS 5.3)
- CVE-2025-46565 — Vite's server.fs.deny bypassed with /. for files under project root (CVSS 5.3)
- CVE-2025-32395 — Vite has an `server.fs.deny` bypass with an invalid `request-target` (CVSS 6.0)
- CVE-2025-31486 — Vite allows server.fs.deny to be bypassed with .svg or relative paths (CVSS 5.3)
- CVE-2025-31125 — Vite Vitejs Improper Access Control Vulnerability (CVSS 7.5) — exploited
- CVE-2025-30208 — Vite bypasses server.fs.deny when using `?raw??` (CVSS 7.5)
- CVE-2025-24010 — Vite allows any websites to send any requests to the development server and read the response (CVSS 6.5)
- CVE-2024-45812 — DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite (CVSS 6.4)
- CVE-2024-45811 — server.fs.deny bypassed when using ?import&raw in vite (CVSS 4.8)
- CVE-2024-31207 — Vite's `server.fs.deny` did not deny requests for patterns with directories (CVSS 5.9)
- CVE-2024-23331 — Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem (CVSS 7.5)