vitejs vulnerabilities

CVEs per yearBy the year they were published

1. 20232
2. 20244
3. 202511
4. 202614

Known exploitedNewest addition to KEV first

• CVE-2025-31125

  Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

  vitejs · vite

  ExploitedMedium5.3

Newest CVEs

• CVE-2026-118662

  Vite: `server.fs.deny` bypassed with queries

  vitejs · vite

  Medium6.9
• CVE-2026-112948

  Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

  vitest-dev · vitest

  Medium6.5
• CVE-2026-112947

  Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

  vitejs · vite

  Medium6.3
• CVE-2026-112946

  Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

  vitejs · vite

  Medium6.3
• CVE-2026-112945

  Vite: Cross origin script execution through Vite custom middleware

  vitejs · vite

  Low2.1
• CVE-2026-112944

  launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

  vitejs · launch-editor

  Medium6.3
• CVE-2026-112943

  launch-editor: escapeCmdArgs() omits % escaping on Windows

  vitejs · launch-editor

  Medium6.3
• CVE-2026-112942

  launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

  vitejs · launch-editor

  High7.5
• CVE-2026-53571

  Vite: `server.fs.deny` bypass on Windows alternate paths

  vitejs · vite

  High8.2
• CVE-2026-53632

  NTLMv2 hash disclosure via UNC path handling on Windows

  vitejs · launch-editor

  Medium5.5