vite-plus (npm)
Advisories
16
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.1.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install vite-plus@1.1.0yarn
yarn add vite-plus@1.1.0pnpm
pnpm add vite-plus@1.1.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-vfpm-58rq-9qcg Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` |
Medium EPSS 0.50% |
>= 0.2.8, <= 1.0.0 | No fix yet |
| GHSA-vfpm-58rq-9qcg Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` |
Medium EPSS 0.50% |
>= 0.2.8, < 1.1.0 | 1.1.0 |
| GHSA-rq7h-c2jc-7f22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine |
Medium EPSS 0.85% |
< 1.1.0 | 1.1.0 |
| GHSA-rq7h-c2jc-7f22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine |
Medium EPSS 0.85% |
<= 1.0.0 | No fix yet |
| GHSA-9jrq-w75r-8gcw Vite: Cross origin script execution through Vite custom middleware |
Low EPSS 0.67% |
<= 1.0.0 | No fix yet |
| GHSA-9jrq-w75r-8gcw Vite: Cross origin script execution through Vite custom middleware |
Low EPSS 0.67% |
< 1.1.0 | 1.1.0 |
| GHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors |
Medium EPSS 0.70% |
< 1.1.0 | 1.1.0 |
| GHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors |
Medium EPSS 0.70% |
<= 1.0.0 | No fix yet |
| GHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows |
Medium EPSS 0.41% |
< 1.1.0 | 1.1.0 |
| GHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows |
Medium EPSS 0.41% |
<= 1.0.0 | No fix yet |
| GHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
High EPSS 1.34% |
< 1.1.0 | 1.1.0 |
| GHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
High EPSS 1.34% |
<= 1.0.0 | No fix yet |
| GHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows |
Medium EPSS 0.41% |
<= 0.1.23 | No fix yet |
| GHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows |
Medium EPSS 0.41% |
< 0.1.24 | 0.1.24 |
| GHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate paths |
Medium EPSS 0.58% |
< 0.1.24 | 0.1.24 |
| GHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate paths |
Medium EPSS 0.58% |
<= 0.1.23 | No fix yet |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor