Vulnerabilities in vitejs
31 resultsCVE-2024-45812MEDIUMDOM Clobbering gadget found in vite bundled scripts that leads to XSS in ViteEPSS 0.6%CVE-2025-58752LOWVite's `server.fs` settings were not applied to HTML filesEPSS 0.6%CVE-2026-53571HIGHVite: `server.fs.deny` bypass on Windows alternate pathsEPSS 0.6%CVE-2024-52011HIGHlaunch-editor vulnerable to command injection via the crafted request on WindowsEPSS 0.5%CVE-2026-112947MEDIUMVite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`EPSS 0.5%CVE-2025-68155HIGH@vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on DevelopmentEPSS 0.5%CVE-2026-112943MEDIUMlaunch-editor: escapeCmdArgs() omits % escaping on WindowsEPSS 0.4%CVE-2026-53632MEDIUMNTLMv2 hash disclosure via UNC path handling on WindowsEPSS 0.4%CVE-2026-112948MEDIUMVitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token fileEPSS 0.4%CVE-2025-24010MEDIUMVite allows any websites to send any requests to the development server and read the responseEPSS 0.3%CVE-2026-118662MEDIUMVite: `server.fs.deny` bypassed with queriesEPSS 0.3%