VI
Product
vite
On CISA KEVExploited in the wild
22
CVEs
1
On KEV
8.3
Max CVSS
6
New 30D
Severity mix
Critical 0High 9Medium 12Low 1
Watch
Add vite to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-31125 In wildKEV | 7.5 | Mar 31 | Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query Affected: >= 6.2.0, < 6.2.4; >= 6.1.0, < 6.1.3; >= 6.0.0, < 6.0.13; >= 5.0.0, < 5.4.16; < 4.5.11 |
| CVE-2024-52011 | 8.3 | Jun 1 | launch-editor vulnerable to command injection via the crafted request on Windows Affected: < 5.4.9 |
| CVE-2026-112942 | 7.5 | Oct 20 | launch-editor: `fs.existsSync()` existence check can be bypassed on Windows Affected: >= 8.3.0, < 8.3.3; >= 8.2.0, < 8.2.4; >= 8.0.0, < 8.1.6; >= 7.0.0, < 7.3.7; < 6.4.4 |
| CVE-2026-53571 | 7.5 | Jun 22 | Vite: `server.fs.deny` bypass on Windows alternate paths Affected: >= 8.0.0, < 8.0.16; >= 7.0.0, < 7.3.5; < 6.4.3 |
| CVE-2026-39364 | 7.5 | Apr 7 | Vite has a `server.fs.deny` bypass with queries Affected: >= 8.0.0, < 8.0.5; >= 7.1.0, < 7.3.2 |
| CVE-2026-39363 | 7.5 | Apr 7 | Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket Affected: >= 8.0.0, < 8.0.5; >= 7.0.0, < 7.3.2; >= 6.0.0, < 6.4.2 |
| CVE-2025-30208 | 7.5 | Mar 24 | Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 Affected: before 4.5.10; 5.0.0 before 5.4.15; 6.0.0 before 6.0.12; 6.1.0 before 6.1.2; 6.2.0 before 6.2.3 |
| CVE-2024-23331 | 7.5 | Jan 19 | Vite is a frontend tooling framework for javascript Affected: 2.7.0 before 2.9.17; 3.0.0 before 3.2.8; 4.0.0 before 4.5.2; 5.0.0 before 5.0.12 |
| CVE-2023-34092 | 7.5 | Jun 1 | Vite provides frontend tooling Affected: 3.0.2 before 3.2.7; 4.0.0 before 4.0.5; 4.1.0 before 4.1.5; 4.2.0 before 4.2.3; 4.3.0 before 4.3.9; 2.9.15 |
| CVE-2025-24010 | 6.5 | Jan 20 | Vite is a frontend tooling framework for javascript Affected: before 4.5.5; 5.0.0 before 5.4.12; 6.0.0 before 6.0.9 |
| CVE-2026-112947 | 6.3 | Oct 20 | Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` Affected: >= 8.3.0, < 8.3.3; >= 8.2.0, < 8.2.4 |
| CVE-2026-112946 | 6.3 | Oct 20 | Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine Affected: >= 8.3.0, < 8.3.3; >= 8.2.0, < 8.2.4; >= 8.0.0, < 8.1.6; >= 7.0.0, < 7.3.7; < 6.4.4 |
| CVE-2026-112944 | 6.3 | Oct 20 | launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors Affected: >= 8.3.0, < 8.3.3; >= 8.2.0, < 8.2.4; >= 8.0.0, < 8.1.6; >= 7.0.0, < 7.3.7; < 6.4.4 |
| CVE-2026-112943 | 6.3 | Oct 20 | launch-editor: escapeCmdArgs() omits % escaping on Windows Affected: >= 8.3.0, < 8.3.3; >= 8.2.0, < 8.2.4; >= 8.0.0, < 8.1.6; >= 7.0.0, < 7.3.7; < 6.4.4 |
| CVE-2023-49293 | 6.1 | Dec 4 | Vite is a website frontend framework Affected: 4.4.0 through 4.4.11; 5.0.0 through 5.0.4; 5.0.0; 5.0.0; 5.0.0; 5.0.0; +18 more |
| CVE-2026-53632 | 5.5 | Jun 22 | NTLMv2 hash disclosure via UNC path handling on Windows Affected: >= 8.0.0, < 8.0.16; >= 7.0.0, < 7.3.5; < 6.4.3 |
| CVE-2026-39365 | 5.3 | Apr 7 | Vite has a Path Traversal in Optimized Deps `.map` Handling Affected: >= 8.0.0, < 8.0.5; >= 7.0.0, < 7.3.2; >= 6.0.0, < 6.4.2 |
| CVE-2025-58752 | 5.3 | Sep 8 | Vite is a frontend tooling framework for JavaScript Affected: before 5.4.20; 6.0.0 before 6.3.6; 7.0.0 before 7.0.7; 7.1.0 before 7.1.5 |
| CVE-2025-58751 | 5.3 | Sep 8 | Vite is a frontend tooling framework for JavaScript Affected: before 5.4.20; 6.0.0 before 6.3.6; 7.0.0 before 7.0.7; 7.1.0 before 7.1.5 |
| CVE-2025-46565 | 5.3 | May 1 | Vite is a frontend tooling framework for javascript Affected: before 4.5.14; 5.0.0 before 5.4.19; 6.0.0 before 6.1.6; 6.2.0 before 6.2.7; 6.3.0 before 6.3.4 |
| CVE-2022-35204 | 4.3 | Aug 18 | Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service Affected: before 2.9.13 |
| CVE-2026-112945 | 2.1 | Oct 20 | Vite: Cross origin script execution through Vite custom middleware Affected: >= 8.3.0, < 8.3.3; >= 8.2.0, < 8.2.4; >= 8.0.0, < 8.1.6; >= 7.0.0, < 7.3.7; < 6.4.4 |
Showing 22