What’s Vulnerable › Products

vitejs vite-plus vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your vitejs vite-plus version is affected

Latest vitejs vite-plus vulnerabilities

• CVE-2026-112948 — Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file (CVSS 6.5)
• CVE-2026-112947 — Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` (CVSS 6.3)
• CVE-2026-112946 — Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine (CVSS 6.3)
• CVE-2026-112945 — Vite: Cross origin script execution through Vite custom middleware (CVSS 2.1)
• CVE-2026-112944 — launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors (CVSS 6.3)
• CVE-2026-112943 — launch-editor: escapeCmdArgs() omits % escaping on Windows (CVSS 6.3)
• CVE-2026-112942 — launch-editor: `fs.existsSync()` existence check can be bypassed on Windows (CVSS 7.5)
• CVE-2026-53632 — NTLMv2 hash disclosure via UNC path handling on Windows (CVSS 5.5)