Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

vite — Vulnerabilities & Security Advisories 19

All 19 CVE vulnerabilities found in vite, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities affecting Vite, a popular frontend build tool. It collects a range of weaknesses, including remote code execution, prototype pollution, and insufficient validation issues, covering advisories from the product's initial public release through the most recent data available. Readers can use this hub to track the vendor's security advisories, understand specific weakness classes such as cross-site scripting or path traversal, and review the historical vulnerability profile of Vite across all supported versions. The collection emphasizes actionable details like affected version ranges and recommended mitigations, helping development teams assess exposure and prioritize patches. By grouping related bugs by category, the page supports informed decision-making for continuous integration pipelines and dependency management. This resource does not duplicate individual CVE records but provides a consolidated view of the tool's overall security posture.

Vendor: vitejs

CVE ID Title CVSS Severity Published
CVE-2026-53571 Vite: `server.fs.deny` bypass on Windows alternate paths CWE-22 - - 2026-06-22
CVE-2026-39365 Vite has a Path Traversal in Optimized Deps `.map` Handling CWE-22 4.3 - 2026-04-07
CVE-2026-39364 Vite has a `server.fs.deny` bypass with queries CWE-180 8.2 High 2026-04-07
CVE-2026-39363 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket CWE-200 8.2 High 2026-04-07
CVE-2025-62522 vite allows server.fs.deny bypass via backslash on Windows CWE-22 7.5AI High AI 2025-10-20
CVE-2025-58752 Vite's `server.fs` settings were not applied to HTML files CWE-23 4.7AI Medium AI 2025-09-08
CVE-2025-58751 Vite middleware may serve files starting with the same name with the public directory CWE-22 5.3AI Medium AI 2025-09-08
CVE-2025-46565 Vite's server.fs.deny bypassed with /. for files under project root CWE-22 6.5AI Medium AI 2025-05-01
CVE-2025-32395 Vite has an `server.fs.deny` bypass with an invalid `request-target` CWE-200 7.5AI High AI 2025-04-10
CVE-2025-31486 Vite allows server.fs.deny to be bypassed with .svg or relative paths CWE-200 5.3 Medium 2025-04-03
CVE-2025-31125 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query CWE-200 5.3 Medium 2025-03-31
CVE-2025-30208 Vite bypasses server.fs.deny when using `?raw??` CWE-200 5.3 Medium 2025-03-24
CVE-2025-24010 Vite allows any websites to send any requests to the development server and read the response CWE-346 6.5 Medium 2025-01-20
CVE-2024-45812 DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite CWE-79 6.4 Medium 2024-09-17
CVE-2024-45811 server.fs.deny bypassed when using ?import&raw in vite CWE-200 4.8 Medium 2024-09-17
CVE-2024-31207 Vite's `server.fs.deny` did not deny requests for patterns with directories CWE-200 5.9 Medium 2024-04-04
CVE-2024-23331 Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem CWE-178 7.5 High 2024-01-19
CVE-2023-49293 Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite CWE-79 6.1 Medium 2023-12-04
CVE-2023-34092 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) CWE-50 7.5 High 2023-06-01

All 19 known CVE vulnerabilities affecting vite with full Chinese analysis, references, and POCs where available.