Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

vite — Vulnerabilities & Security Advisories 19

All 19 CVE vulnerabilities found in vite, with AI-generated Chinese analysis, references, and POCs.

This page aggregates Common Weakness Enumeration (CWE) and CVE vulnerability records associated with the Vite build tool, a popular web development framework. It collects security advisories, bug reports, and configuration flaws affecting Vite and its ecosystem plugins, covering the period from its initial public release through the most recent updates. Here, users can track specific vendor or community advisories related to Vite, understand the characteristics and impact of specific weakness classes such as cross-site scripting or remote code execution, and look up the historical vulnerability timeline for this product to assess risk exposure over time. The data includes information on severity ratings, affected versions, and remediation strategies provided by maintainers. This resource is intended for developers, security analysts, and DevOps engineers who need to evaluate the security posture of Vite-based projects. By centralizing this information, the page facilitates easier compliance auditing and helps teams prioritize patching efforts based on the actual risk landscape. Readers can use these records to inform their dependency management decisions and stay informed about emerging threats targeting the Vite architecture. The content is structured to allow quick reference for known issues while providing context for how vulnerabilities are addressed in the open-source community. This aggregation serves as a reference point for understanding the security history and current status of Vite-related components without requiring direct access to individual GitHub repositories or advisory feeds.

Vendor: vitejs

CVE IDTitleCVSSSeverityPublished
CVE-2026-53571 Vite: `server.fs.deny` bypass on Windows alternate paths CWE-22--2026-06-22
CVE-2026-39365 Vite has a Path Traversal in Optimized Deps `.map` Handling CWE-22 4.3 -2026-04-07
CVE-2026-39364 Vite has a `server.fs.deny` bypass with queries CWE-180 7.5 -2026-04-07
CVE-2026-39363 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket CWE-200 7.5 -2026-04-07
CVE-2025-62522 vite allows server.fs.deny bypass via backslash on Windows CWE-22 7.5AIHighAI2025-10-20
CVE-2025-58752 Vite's `server.fs` settings were not applied to HTML files CWE-23 4.7AIMediumAI2025-09-08
CVE-2025-58751 Vite middleware may serve files starting with the same name with the public directory CWE-22 5.3AIMediumAI2025-09-08
CVE-2025-46565 Vite's server.fs.deny bypassed with /. for files under project root CWE-22 6.5AIMediumAI2025-05-01
CVE-2025-32395 Vite has an `server.fs.deny` bypass with an invalid `request-target` CWE-200 7.5AIHighAI2025-04-10
CVE-2025-31486 Vite allows server.fs.deny to be bypassed with .svg or relative paths CWE-200 5.3 Medium2025-04-03
CVE-2025-31125 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query CWE-200 5.3 Medium2025-03-31
CVE-2025-30208 Vite bypasses server.fs.deny when using `?raw??` CWE-200 5.3 Medium2025-03-24
CVE-2025-24010 Vite allows any websites to send any requests to the development server and read the response CWE-346 6.5 Medium2025-01-20
CVE-2024-45812 DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite CWE-79 6.4 Medium2024-09-17
CVE-2024-45811 server.fs.deny bypassed when using ?import&raw in vite CWE-200 4.8 Medium2024-09-17
CVE-2024-31207 Vite's `server.fs.deny` did not deny requests for patterns with directories CWE-200 5.9 Medium2024-04-04
CVE-2024-23331 Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem CWE-178 7.5 High2024-01-19
CVE-2023-49293 Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite CWE-79 6.1 Medium2023-12-04
CVE-2023-34092 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) CWE-50 7.5 High2023-06-01

All 19 known CVE vulnerabilities affecting vite with full Chinese analysis, references, and POCs where available.