vite (npm)
Next generation frontend tooling. It's fast!
Advisories
187
Latest version
8.3.5
Released Oct 21, 2026
License
MIT
OpenSSF Scorecard
6.8 / 10
How to fix
Upgrading to 8.3.3 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install vite@8.3.5yarn
yarn add vite@8.3.5pnpm
pnpm add vite@8.3.5Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-8g5g-mxqh-grgj Vite: `server.fs.deny` bypassed with queries |
Medium EPSS 0.29% |
No fix yet | |
| GHSA-8g5g-mxqh-grgj Vite: `server.fs.deny` bypassed with queries |
Medium EPSS 0.29% |
>= 6.4.4, < 6.4.5 | 6.4.5 |
| GHSA-vfpm-58rq-9qcg Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` |
Medium EPSS 0.50% |
>= 8.2.0, < 8.2.4 | 8.2.4 |
| GHSA-vfpm-58rq-9qcg Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` |
Medium EPSS 0.50% |
>= 8.3.0, < 8.3.3 | 8.3.3 |
| GHSA-vfpm-58rq-9qcg Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` |
Medium EPSS 0.50% |
>= 8.2.0, <= 8.2.3 | No fix yet |
| GHSA-vfpm-58rq-9qcg Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` |
Medium EPSS 0.50% |
>= 8.3.0, <= 8.3.2 | No fix yet |
| GHSA-rq7h-c2jc-7f22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine |
Medium EPSS 0.85% |
>= 8.3.0, < 8.3.3 | 8.3.3 |
| GHSA-rq7h-c2jc-7f22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine |
Medium EPSS 0.85% |
<= 6.4.3 | No fix yet |
| GHSA-rq7h-c2jc-7f22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine |
Medium EPSS 0.85% |
>= 7.0.0, <= 7.3.6 | No fix yet |
| GHSA-rq7h-c2jc-7f22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine |
Medium EPSS 0.85% |
>= 8.2.0, <= 8.2.3 | No fix yet |
| GHSA-rq7h-c2jc-7f22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine |
Medium EPSS 0.85% |
>= 8.0.0, <= 8.1.5 | No fix yet |
| GHSA-rq7h-c2jc-7f22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine |
Medium EPSS 0.85% |
>= 8.3.0, <= 8.3.2 | No fix yet |
| GHSA-rq7h-c2jc-7f22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine |
Medium EPSS 0.85% |
< 6.4.4 | 6.4.4 |
| GHSA-rq7h-c2jc-7f22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine |
Medium EPSS 0.85% |
>= 7.0.0, < 7.3.7 | 7.3.7 |
| GHSA-rq7h-c2jc-7f22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine |
Medium EPSS 0.85% |
>= 8.0.0, < 8.1.6 | 8.1.6 |
| GHSA-rq7h-c2jc-7f22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine |
Medium EPSS 0.85% |
>= 8.2.0, < 8.2.4 | 8.2.4 |
| GHSA-9jrq-w75r-8gcw Vite: Cross origin script execution through Vite custom middleware |
Low EPSS 0.67% |
>= 8.3.0, < 8.3.3 | 8.3.3 |
| GHSA-9jrq-w75r-8gcw Vite: Cross origin script execution through Vite custom middleware |
Low EPSS 0.67% |
>= 8.2.0, < 8.2.4 | 8.2.4 |
| GHSA-9jrq-w75r-8gcw Vite: Cross origin script execution through Vite custom middleware |
Low EPSS 0.67% |
>= 8.0.0, < 8.1.6 | 8.1.6 |
| GHSA-9jrq-w75r-8gcw Vite: Cross origin script execution through Vite custom middleware |
Low EPSS 0.67% |
>= 7.0.0, < 7.3.7 | 7.3.7 |
| GHSA-9jrq-w75r-8gcw Vite: Cross origin script execution through Vite custom middleware |
Low EPSS 0.67% |
< 6.4.4 | 6.4.4 |
| GHSA-9jrq-w75r-8gcw Vite: Cross origin script execution through Vite custom middleware |
Low EPSS 0.67% |
>= 8.3.0, <= 8.3.2 | No fix yet |
| GHSA-9jrq-w75r-8gcw Vite: Cross origin script execution through Vite custom middleware |
Low EPSS 0.67% |
>= 8.2.0, <= 8.2.3 | No fix yet |
| GHSA-9jrq-w75r-8gcw Vite: Cross origin script execution through Vite custom middleware |
Low EPSS 0.67% |
>= 8.0.0, <= 8.1.5 | No fix yet |
| GHSA-9jrq-w75r-8gcw Vite: Cross origin script execution through Vite custom middleware |
Low EPSS 0.67% |
<= 6.4.3 | No fix yet |
| GHSA-9jrq-w75r-8gcw Vite: Cross origin script execution through Vite custom middleware |
Low EPSS 0.67% |
>= 7.0.0, <= 7.3.6 | No fix yet |
| GHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors |
Medium EPSS 0.70% |
>= 8.2.0, <= 8.2.3 | No fix yet |
| GHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors |
Medium EPSS 0.70% |
>= 8.3.0, < 8.3.3 | 8.3.3 |
| GHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors |
Medium EPSS 0.70% |
>= 8.2.0, < 8.2.4 | 8.2.4 |
| GHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors |
Medium EPSS 0.70% |
>= 8.0.0, < 8.1.6 | 8.1.6 |
| GHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors |
Medium EPSS 0.70% |
>= 7.0.0, < 7.3.7 | 7.3.7 |
| GHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors |
Medium EPSS 0.70% |
< 6.4.4 | 6.4.4 |
| GHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors |
Medium EPSS 0.70% |
>= 8.3.0, <= 8.3.2 | No fix yet |
| GHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors |
Medium EPSS 0.70% |
<= 6.4.3 | No fix yet |
| GHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors |
Medium EPSS 0.70% |
>= 7.0.0, <= 7.3.6 | No fix yet |
| GHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors |
Medium EPSS 0.70% |
>= 8.0.0, <= 8.1.5 | No fix yet |
| GHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows |
Medium EPSS 0.41% |
<= 6.4.3 | No fix yet |
| GHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows |
Medium EPSS 0.41% |
>= 8.3.0, < 8.3.3 | 8.3.3 |
| GHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows |
Medium EPSS 0.41% |
>= 8.2.0, < 8.2.4 | 8.2.4 |
| GHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows |
Medium EPSS 0.41% |
>= 8.0.0, < 8.1.6 | 8.1.6 |
| GHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows |
Medium EPSS 0.41% |
>= 7.0.0, < 7.3.7 | 7.3.7 |
| GHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows |
Medium EPSS 0.41% |
< 6.4.4 | 6.4.4 |
| GHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows |
Medium EPSS 0.41% |
>= 8.3.0, <= 8.3.2 | No fix yet |
| GHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows |
Medium EPSS 0.41% |
>= 8.2.0, <= 8.2.3 | No fix yet |
| GHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows |
Medium EPSS 0.41% |
>= 8.0.0, <= 8.1.5 | No fix yet |
| GHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows |
Medium EPSS 0.41% |
>= 7.0.0, <= 7.3.6 | No fix yet |
| GHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
High EPSS 1.34% |
< 6.4.4 | 6.4.4 |
| GHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
High EPSS 1.34% |
>= 8.3.0, <= 8.3.2 | No fix yet |
| GHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
High EPSS 1.34% |
>= 8.2.0, <= 8.2.3 | No fix yet |
| GHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
High EPSS 1.34% |
>= 8.0.0, <= 8.1.5 | No fix yet |
| GHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
High EPSS 1.34% |
>= 7.0.0, <= 7.3.6 | No fix yet |
| GHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
High EPSS 1.34% |
<= 6.4.3 | No fix yet |
| GHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
High EPSS 1.34% |
>= 8.3.0, < 8.3.3 | 8.3.3 |
| GHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
High EPSS 1.34% |
>= 8.2.0, < 8.2.4 | 8.2.4 |
| GHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
High EPSS 1.34% |
>= 8.0.0, < 8.1.6 | 8.1.6 |
| GHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
High EPSS 1.34% |
>= 7.0.0, < 7.3.7 | 7.3.7 |
| GHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows |
Medium EPSS 0.41% |
< 6.4.3 | 6.4.3 |
| GHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows |
Medium EPSS 0.41% |
>= 7.0.0, < 7.3.5 | 7.3.5 |
| GHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows |
Medium EPSS 0.41% |
>= 8.0.0, < 8.0.16 | 8.0.16 |
| GHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows |
Medium EPSS 0.41% |
<= 6.4.2 | No fix yet |
| GHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows |
Medium EPSS 0.41% |
>= 7.0.0, <= 7.3.4 | No fix yet |
| GHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows |
Medium EPSS 0.41% |
>= 8.0.0, <= 8.0.15 | No fix yet |
| GHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate paths |
Medium EPSS 0.58% |
<= 6.4.2 | No fix yet |
| GHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate paths |
Medium EPSS 0.58% |
>= 7.0.0, <= 7.3.4 | No fix yet |
| GHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate paths |
Medium EPSS 0.58% |
>= 8.0.0, <= 8.0.15 | No fix yet |
| GHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate paths |
Medium EPSS 0.58% |
< 6.4.3 | 6.4.3 |
| GHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate paths |
Medium EPSS 0.58% |
>= 7.0.0, < 7.3.5 | 7.3.5 |
| GHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate paths |
Medium EPSS 0.58% |
>= 8.0.0, < 8.0.16 | 8.0.16 |
| GHSA-c27g-q93r-2cwf launch-editor vulnerable to command injection via the crafted request on Windows |
High EPSS 0.51% |
< 5.4.9 | 5.4.9 |
| GHSA-c27g-q93r-2cwf launch-editor vulnerable to command injection via the crafted request on Windows |
High EPSS 0.51% |
<= 5.4.8 | No fix yet |
| GHSA-4w7w-66w2-5vf9 Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling |
Medium EPSS 0.91% |
>= 7.0.0, < 7.3.2 | 7.3.2 |
| GHSA-4w7w-66w2-5vf9 Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling |
Medium EPSS 0.91% |
< 6.4.2 | 6.4.2 |
| GHSA-4w7w-66w2-5vf9 Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling |
Medium EPSS 0.91% |
>= 8.0.0, <= 8.0.4 | No fix yet |
| GHSA-4w7w-66w2-5vf9 Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling |
Medium EPSS 0.91% |
>= 7.0.0, <= 7.3.1 | No fix yet |
| GHSA-4w7w-66w2-5vf9 Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling |
Medium EPSS 0.91% |
<= 6.4.1 | No fix yet |
| GHSA-4w7w-66w2-5vf9 Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling |
Medium EPSS 0.91% |
>= 8.0.0, < 8.0.5 | 8.0.5 |
| GHSA-v2wj-q39q-566r Vite: `server.fs.deny` bypassed with queries |
High EPSS 2.26% |
>= 7.1.0, < 7.3.2 | 7.3.2 |
| GHSA-v2wj-q39q-566r Vite: `server.fs.deny` bypassed with queries |
High EPSS 2.26% |
>= 7.1.0, <= 7.3.1 | No fix yet |
| GHSA-v2wj-q39q-566r Vite: `server.fs.deny` bypassed with queries |
High EPSS 2.26% |
>= 8.0.0, <= 8.0.4 | No fix yet |
| GHSA-v2wj-q39q-566r Vite: `server.fs.deny` bypassed with queries |
High EPSS 2.26% |
>= 8.0.0, < 8.0.5 | 8.0.5 |
| GHSA-p9ff-h696-f583 Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket |
High EPSS 3.40% |
>= 8.0.0, <= 8.0.4 | No fix yet |
| GHSA-p9ff-h696-f583 Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket |
High EPSS 3.40% |
>= 7.0.0, <= 7.3.1 | No fix yet |
| GHSA-p9ff-h696-f583 Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket |
High EPSS 3.40% |
>= 6.0.0, <= 6.4.1 | No fix yet |
| GHSA-p9ff-h696-f583 Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket |
High EPSS 3.40% |
>= 8.0.0, < 8.0.5 | 8.0.5 |
| GHSA-p9ff-h696-f583 Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket |
High EPSS 3.40% |
>= 7.0.0, < 7.3.2 | 7.3.2 |
| GHSA-p9ff-h696-f583 Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket |
High EPSS 3.40% |
>= 6.0.0, < 6.4.2 | 6.4.2 |
| GHSA-93m4-6634-74q7 vite allows server.fs.deny bypass via backslash on Windows |
Medium EPSS 1.05% |
>= 3.2.9, < 4.0.0 | 4.0.0 |
| GHSA-93m4-6634-74q7 vite allows server.fs.deny bypass via backslash on Windows |
Medium EPSS 1.05% |
>= 7.1.0, <= 7.1.10 | No fix yet |
| GHSA-93m4-6634-74q7 vite allows server.fs.deny bypass via backslash on Windows |
Medium EPSS 1.05% |
>= 7.0.0, <= 7.0.7 | No fix yet |
| GHSA-93m4-6634-74q7 vite allows server.fs.deny bypass via backslash on Windows |
Medium EPSS 1.05% |
>= 6.0.0, <= 6.4.0 | No fix yet |
| GHSA-93m4-6634-74q7 vite allows server.fs.deny bypass via backslash on Windows |
Medium EPSS 1.05% |
>= 2.9.18, < 3.0.0 | 3.0.0 |
| GHSA-93m4-6634-74q7 vite allows server.fs.deny bypass via backslash on Windows |
Medium EPSS 1.05% |
>= 4.5.3, < 5.0.0 | 5.0.0 |
| GHSA-93m4-6634-74q7 vite allows server.fs.deny bypass via backslash on Windows |
Medium EPSS 1.05% |
>= 5.2.6, <= 5.4.20 | No fix yet |
| GHSA-93m4-6634-74q7 vite allows server.fs.deny bypass via backslash on Windows |
Medium EPSS 1.05% |
>= 7.1.0, < 7.1.11 | 7.1.11 |
| GHSA-93m4-6634-74q7 vite allows server.fs.deny bypass via backslash on Windows |
Medium EPSS 1.05% |
>= 7.0.0, < 7.0.8 | 7.0.8 |
| GHSA-93m4-6634-74q7 vite allows server.fs.deny bypass via backslash on Windows |
Medium EPSS 1.05% |
>= 6.0.0, < 6.4.1 | 6.4.1 |
| GHSA-93m4-6634-74q7 vite allows server.fs.deny bypass via backslash on Windows |
Medium EPSS 1.05% |
>= 2.9.18, < 5.4.21 | 5.4.21 |
| GHSA-93m4-6634-74q7 vite allows server.fs.deny bypass via backslash on Windows |
Medium EPSS 1.05% |
>= 3.2.9, < 5.4.21 | 5.4.21 |
| GHSA-93m4-6634-74q7 vite allows server.fs.deny bypass via backslash on Windows |
Medium EPSS 1.05% |
>= 4.5.3, < 5.4.21 | 5.4.21 |
| GHSA-93m4-6634-74q7 vite allows server.fs.deny bypass via backslash on Windows |
Medium EPSS 1.05% |
>= 5.2.6, < 5.4.21 | 5.4.21 |
| GHSA-jqfw-vq24-v9c3 Vite's `server.fs` settings were not applied to HTML files |
Low EPSS 0.61% |
>= 7.0.0, < 7.0.7 | 7.0.7 |
| GHSA-jqfw-vq24-v9c3 Vite's `server.fs` settings were not applied to HTML files |
Low EPSS 0.61% |
>= 6.0.0, <= 6.3.5 | No fix yet |
| GHSA-jqfw-vq24-v9c3 Vite's `server.fs` settings were not applied to HTML files |
Low EPSS 0.61% |
>= 7.0.0, <= 7.0.6 | No fix yet |
| GHSA-jqfw-vq24-v9c3 Vite's `server.fs` settings were not applied to HTML files |
Low EPSS 0.61% |
>= 7.1.0, <= 7.1.4 | No fix yet |
| GHSA-jqfw-vq24-v9c3 Vite's `server.fs` settings were not applied to HTML files |
Low EPSS 0.61% |
< 5.4.20 | 5.4.20 |
| GHSA-jqfw-vq24-v9c3 Vite's `server.fs` settings were not applied to HTML files |
Low EPSS 0.61% |
>= 6.0.0, < 6.3.6 | 6.3.6 |
| GHSA-jqfw-vq24-v9c3 Vite's `server.fs` settings were not applied to HTML files |
Low EPSS 0.61% |
<= 5.4.19 | No fix yet |
| GHSA-jqfw-vq24-v9c3 Vite's `server.fs` settings were not applied to HTML files |
Low EPSS 0.61% |
>= 7.1.0, < 7.1.5 | 7.1.5 |
| GHSA-g4jq-h2w9-997c Vite middleware may serve files starting with the same name with the public directory |
Low EPSS 1.21% |
>= 7.0.0, < 7.0.7 | 7.0.7 |
| GHSA-g4jq-h2w9-997c Vite middleware may serve files starting with the same name with the public directory |
Low EPSS 1.21% |
<= 5.4.19 | No fix yet |
| GHSA-g4jq-h2w9-997c Vite middleware may serve files starting with the same name with the public directory |
Low EPSS 1.21% |
>= 6.0.0, <= 6.3.5 | No fix yet |
| GHSA-g4jq-h2w9-997c Vite middleware may serve files starting with the same name with the public directory |
Low EPSS 1.21% |
>= 7.0.0, <= 7.0.6 | No fix yet |
| GHSA-g4jq-h2w9-997c Vite middleware may serve files starting with the same name with the public directory |
Low EPSS 1.21% |
>= 7.1.0, <= 7.1.4 | No fix yet |
| GHSA-g4jq-h2w9-997c Vite middleware may serve files starting with the same name with the public directory |
Low EPSS 1.21% |
< 5.4.20 | 5.4.20 |
| GHSA-g4jq-h2w9-997c Vite middleware may serve files starting with the same name with the public directory |
Low EPSS 1.21% |
>= 6.0.0, < 6.3.6 | 6.3.6 |
| GHSA-g4jq-h2w9-997c Vite middleware may serve files starting with the same name with the public directory |
Low EPSS 1.21% |
>= 7.1.0, < 7.1.5 | 7.1.5 |
| GHSA-859w-5945-r5v3 Vite's server.fs.deny bypassed with /. for files under project root |
Medium EPSS 1.22% |
<= 4.5.13 | No fix yet |
| GHSA-859w-5945-r5v3 Vite's server.fs.deny bypassed with /. for files under project root |
Medium EPSS 1.22% |
>= 6.3.0, < 6.3.4 | 6.3.4 |
| GHSA-859w-5945-r5v3 Vite's server.fs.deny bypassed with /. for files under project root |
Medium EPSS 1.22% |
>= 6.2.0, < 6.2.7 | 6.2.7 |
| GHSA-859w-5945-r5v3 Vite's server.fs.deny bypassed with /. for files under project root |
Medium EPSS 1.22% |
< 4.5.14 | 4.5.14 |
| GHSA-859w-5945-r5v3 Vite's server.fs.deny bypassed with /. for files under project root |
Medium EPSS 1.22% |
>= 5.0.0, < 5.4.19 | 5.4.19 |
| GHSA-859w-5945-r5v3 Vite's server.fs.deny bypassed with /. for files under project root |
Medium EPSS 1.22% |
>= 6.0.0, < 6.1.6 | 6.1.6 |
| GHSA-859w-5945-r5v3 Vite's server.fs.deny bypassed with /. for files under project root |
Medium EPSS 1.22% |
>= 5.0.0, <= 5.4.18 | No fix yet |
| GHSA-859w-5945-r5v3 Vite's server.fs.deny bypassed with /. for files under project root |
Medium EPSS 1.22% |
>= 6.0.0, <= 6.1.5 | No fix yet |
| GHSA-859w-5945-r5v3 Vite's server.fs.deny bypassed with /. for files under project root |
Medium EPSS 1.22% |
>= 6.2.0, <= 6.2.6 | No fix yet |
| GHSA-859w-5945-r5v3 Vite's server.fs.deny bypassed with /. for files under project root |
Medium EPSS 1.22% |
>= 6.3.0, <= 6.3.3 | No fix yet |
| GHSA-356w-63v5-8wf4 Vite has an `server.fs.deny` bypass with an invalid `request-target` |
Medium EPSS 1.77% |
< 4.5.13 | 4.5.13 |
| GHSA-356w-63v5-8wf4 Vite has an `server.fs.deny` bypass with an invalid `request-target` |
Medium EPSS 1.77% |
>= 5.0.0, < 5.4.18 | 5.4.18 |
| GHSA-356w-63v5-8wf4 Vite has an `server.fs.deny` bypass with an invalid `request-target` |
Medium EPSS 1.77% |
>= 6.2.0, < 6.2.6 | 6.2.6 |
| GHSA-356w-63v5-8wf4 Vite has an `server.fs.deny` bypass with an invalid `request-target` |
Medium EPSS 1.77% |
>= 6.1.0, < 6.1.5 | 6.1.5 |
| GHSA-356w-63v5-8wf4 Vite has an `server.fs.deny` bypass with an invalid `request-target` |
Medium EPSS 1.77% |
>= 6.0.0, < 6.0.15 | 6.0.15 |
| GHSA-xcj6-pq6g-qj4x Vite allows server.fs.deny to be bypassed with .svg or relative paths |
Medium EPSS 40.46% |
>= 6.1.0, < 6.1.4 | 6.1.4 |
| GHSA-xcj6-pq6g-qj4x Vite allows server.fs.deny to be bypassed with .svg or relative paths |
Medium EPSS 40.46% |
< 4.5.12 | 4.5.12 |
| GHSA-xcj6-pq6g-qj4x Vite allows server.fs.deny to be bypassed with .svg or relative paths |
Medium EPSS 40.46% |
>= 6.2.0, < 6.2.5 | 6.2.5 |
| GHSA-xcj6-pq6g-qj4x Vite allows server.fs.deny to be bypassed with .svg or relative paths |
Medium EPSS 40.46% |
>= 5.0.0, < 5.4.17 | 5.4.17 |
| GHSA-xcj6-pq6g-qj4x Vite allows server.fs.deny to be bypassed with .svg or relative paths |
Medium EPSS 40.46% |
>= 6.0.0, < 6.0.14 | 6.0.14 |
| GHSA-4r4m-qw57-chr8 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query Known exploited |
High EPSS 74.94% |
>= 6.1.0, < 6.1.3 | 6.1.3 |
| GHSA-4r4m-qw57-chr8 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query Known exploited |
High EPSS 74.94% |
>= 6.2.0, < 6.2.4 | 6.2.4 |
| GHSA-4r4m-qw57-chr8 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query Known exploited |
High EPSS 74.94% |
>= 6.0.0, < 6.0.13 | 6.0.13 |
| GHSA-4r4m-qw57-chr8 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query Known exploited |
High EPSS 74.94% |
>= 5.0.0, < 5.4.16 | 5.4.16 |
| GHSA-4r4m-qw57-chr8 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query Known exploited |
High EPSS 74.94% |
< 4.5.11 | 4.5.11 |
| GHSA-4r4m-qw57-chr8 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query Known exploited |
High EPSS 74.94% |
>= 6.2.0, < 6.2.4 | 6.2.4 |
| GHSA-4r4m-qw57-chr8 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query Known exploited |
High EPSS 74.94% |
>= 6.1.0, < 6.1.3 | 6.1.3 |
| GHSA-4r4m-qw57-chr8 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query Known exploited |
High EPSS 74.94% |
>= 6.0.0, < 6.0.13 | 6.0.13 |
| GHSA-4r4m-qw57-chr8 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query Known exploited |
High EPSS 74.94% |
>= 5.0.0, < 5.4.16 | 5.4.16 |
| GHSA-4r4m-qw57-chr8 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query Known exploited |
High EPSS 74.94% |
< 4.5.11 | 4.5.11 |
| GHSA-x574-m823-4x7w Vite bypasses server.fs.deny when using ?raw?? |
High EPSS 74.77% |
>= 5.0.0, < 5.4.15 | 5.4.15 |
| GHSA-x574-m823-4x7w Vite bypasses server.fs.deny when using ?raw?? |
High EPSS 74.77% |
>= 6.2.0, < 6.2.3 | 6.2.3 |
| GHSA-x574-m823-4x7w Vite bypasses server.fs.deny when using ?raw?? |
High EPSS 74.77% |
>= 6.1.0, < 6.1.2 | 6.1.2 |
| GHSA-x574-m823-4x7w Vite bypasses server.fs.deny when using ?raw?? |
High EPSS 74.77% |
>= 6.0.0, < 6.0.12 | 6.0.12 |
| GHSA-x574-m823-4x7w Vite bypasses server.fs.deny when using ?raw?? |
High EPSS 74.77% |
< 4.5.10 | 4.5.10 |
| GHSA-vg6x-rcgg-rjx6 Websites were able to send any requests to the development server and read the response in vite |
Medium EPSS 0.55% |
>= 5.0.0, < 5.4.12 | 5.4.12 |
| GHSA-vg6x-rcgg-rjx6 Websites were able to send any requests to the development server and read the response in vite |
Medium EPSS 0.55% |
< 4.5.6 | 4.5.6 |
| GHSA-vg6x-rcgg-rjx6 Websites were able to send any requests to the development server and read the response in vite |
Medium EPSS 0.55% |
>= 6.0.0, < 6.0.9 | 6.0.9 |
| GHSA-64vr-g452-qvp3 Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS |
Medium EPSS 0.64% |
>= 5.0.0, < 5.1.8 | 5.1.8 |
| GHSA-64vr-g452-qvp3 Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS |
Medium EPSS 0.64% |
>= 5.3.0, < 5.3.6 | 5.3.6 |
| GHSA-64vr-g452-qvp3 Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS |
Medium EPSS 0.64% |
>= 5.2.0, < 5.2.14 | 5.2.14 |
| GHSA-64vr-g452-qvp3 Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS |
Medium EPSS 0.64% |
>= 4.0.0, < 4.5.4 | 4.5.4 |
| GHSA-64vr-g452-qvp3 Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS |
Medium EPSS 0.64% |
< 3.2.11 | 3.2.11 |
| GHSA-64vr-g452-qvp3 Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS |
Medium EPSS 0.64% |
>= 5.4.0, < 5.4.6 | 5.4.6 |
| GHSA-9cwx-2883-4wfx Vite's `server.fs.deny` is bypassed when using `?import&raw` |
Medium EPSS 1.10% |
< 3.2.11 | 3.2.11 |
| GHSA-9cwx-2883-4wfx Vite's `server.fs.deny` is bypassed when using `?import&raw` |
Medium EPSS 1.10% |
>= 5.0.0, < 5.1.8 | 5.1.8 |
| GHSA-9cwx-2883-4wfx Vite's `server.fs.deny` is bypassed when using `?import&raw` |
Medium EPSS 1.10% |
>= 4.0.0, < 4.5.4 | 4.5.4 |
| GHSA-9cwx-2883-4wfx Vite's `server.fs.deny` is bypassed when using `?import&raw` |
Medium EPSS 1.10% |
>= 5.2.0, < 5.2.14 | 5.2.14 |
| GHSA-9cwx-2883-4wfx Vite's `server.fs.deny` is bypassed when using `?import&raw` |
Medium EPSS 1.10% |
>= 5.3.0, < 5.3.6 | 5.3.6 |
| GHSA-9cwx-2883-4wfx Vite's `server.fs.deny` is bypassed when using `?import&raw` |
Medium EPSS 1.10% |
>= 5.4.0, < 5.4.6 | 5.4.6 |
| GHSA-8jhw-289h-jh2g Vite's `server.fs.deny` did not deny requests for patterns with directories. |
Medium EPSS 0.71% |
>= 2.7.0, < 2.9.18 | 2.9.18 |
| GHSA-8jhw-289h-jh2g Vite's `server.fs.deny` did not deny requests for patterns with directories. |
Medium EPSS 0.71% |
>= 5.2.0, < 5.2.6 | 5.2.6 |
| GHSA-8jhw-289h-jh2g Vite's `server.fs.deny` did not deny requests for patterns with directories. |
Medium EPSS 0.71% |
>= 5.1.0, < 5.1.7 | 5.1.7 |
| GHSA-8jhw-289h-jh2g Vite's `server.fs.deny` did not deny requests for patterns with directories. |
Medium EPSS 0.71% |
>= 5.0.0, < 5.0.13 | 5.0.13 |
| GHSA-8jhw-289h-jh2g Vite's `server.fs.deny` did not deny requests for patterns with directories. |
Medium EPSS 0.71% |
>= 4.0.0, < 4.5.3 | 4.5.3 |
| GHSA-8jhw-289h-jh2g Vite's `server.fs.deny` did not deny requests for patterns with directories. |
Medium EPSS 0.71% |
>= 3.0.0, < 3.2.10 | 3.2.10 |
| GHSA-c24v-8rfc-w8vw Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem |
High EPSS 0.78% |
>= 3.0.0, < 3.2.8 | 3.2.8 |
| GHSA-c24v-8rfc-w8vw Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem |
High EPSS 0.78% |
>= 5.0.0, < 5.0.12 | 5.0.12 |
| GHSA-c24v-8rfc-w8vw Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem |
High EPSS 0.78% |
>= 4.0.0, < 4.5.2 | 4.5.2 |
| GHSA-c24v-8rfc-w8vw Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem |
High EPSS 0.78% |
>= 2.7.0, < 2.9.17 | 2.9.17 |
| GHSA-92r3-m2mg-pj97 Vite XSS vulnerability in `server.transformIndexHtml` via URL payload |
Medium EPSS 1.00% |
>= 4.5.0, < 4.5.1 | 4.5.1 |
| GHSA-92r3-m2mg-pj97 Vite XSS vulnerability in `server.transformIndexHtml` via URL payload |
Medium EPSS 1.00% |
>= 5.0.0, < 5.0.5 | 5.0.5 |
| GHSA-92r3-m2mg-pj97 Vite XSS vulnerability in `server.transformIndexHtml` via URL payload |
Medium EPSS 1.00% |
>= 4.4.0, < 4.4.12 | 4.4.12 |
| GHSA-353f-5xf4-qw67 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) |
High EPSS 3.15% |
>= 3.0.2, < 3.2.7 | 3.2.7 |
| GHSA-353f-5xf4-qw67 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) |
High EPSS 3.15% |
< 2.9.16 | 2.9.16 |
| GHSA-353f-5xf4-qw67 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) |
High EPSS 3.15% |
>= 4.0.0, < 4.0.5 | 4.0.5 |
| GHSA-353f-5xf4-qw67 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) |
High EPSS 3.15% |
>= 4.3.0, < 4.3.9 | 4.3.9 |
| GHSA-353f-5xf4-qw67 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) |
High EPSS 3.15% |
>= 4.2.0, < 4.2.3 | 4.2.3 |
| GHSA-353f-5xf4-qw67 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) |
High EPSS 3.15% |
>= 4.1.0, < 4.1.5 | 4.1.5 |
| GHSA-mv48-hcvh-8jj8 Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service |
Medium EPSS 1.29% |
< 2.9.13 | 2.9.13 |
| GHSA-mv48-hcvh-8jj8 Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service |
Medium EPSS 1.29% |
>= 3.0.0-alpha.0, < 3.0.0-beta.4 | 3.0.0-beta.4 |
Source: git+https://github.com/vitejs/vite.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor