Search for packages
| purl | pkg:npm/vite@5.4.10 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-b2m1-kmdu-ykgt
Aliases: CVE-2025-58752 GHSA-jqfw-vq24-v9c3 |
Vite's `server.fs` settings were not applied to HTML files Any HTML files on the machine were served regardless of the `server.fs` settings. |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-cwjw-gp95-5uad
Aliases: CVE-2025-31125 GHSA-4r4m-qw57-chr8 |
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query The contents of arbitrary files can be returned to the browser. |
Affected by 6 other vulnerabilities. Affected by 1 other vulnerability. Affected by 7 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 7 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 7 other vulnerabilities. Affected by 4 other vulnerabilities. |
|
VCID-gdv1-n78f-tud7
Aliases: CVE-2025-24010 GHSA-vg6x-rcgg-rjx6 |
Websites were able to send any requests to the development server and read the response in vite Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. > [!WARNING] > This vulnerability even applies to users that only run the Vite dev server on the local machine and does not expose the dev server to the network. |
Affected by 8 other vulnerabilities. Affected by 9 other vulnerabilities. |
|
VCID-gefx-xng3-k3f4
Aliases: CVE-2025-58751 GHSA-g4jq-h2w9-997c |
Vite middleware may serve files starting with the same name with the public directory Files starting with the same name with the public directory were served bypassing the `server.fs` settings. |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-jxyb-k93s-g3e8
Aliases: CVE-2025-30208 GHSA-x574-m823-4x7w |
Vite bypasses server.fs.deny when using ?raw?? The contents of arbitrary files can be returned to the browser. |
Affected by 7 other vulnerabilities. Affected by 8 other vulnerabilities. Affected by 8 other vulnerabilities. Affected by 8 other vulnerabilities. |
|
VCID-na8b-yqpp-p7fj
Aliases: CVE-2025-46565 GHSA-859w-5945-r5v3 |
Duplicate This advisory duplicates another. |
Affected by 3 other vulnerabilities. Affected by 1 other vulnerability. Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. |
|
VCID-q59b-2z2s-mfbt
Aliases: CVE-2025-31486 GHSA-xcj6-pq6g-qj4x |
Vite allows server.fs.deny to be bypassed with .svg or relative paths The contents of arbitrary files can be returned to the browser. |
Affected by 5 other vulnerabilities. Affected by 6 other vulnerabilities. Affected by 6 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-t716-h35b-9kf2
Aliases: CVE-2025-32395 GHSA-356w-63v5-8wf4 |
Vite has an `server.fs.deny` bypass with an invalid `request-target` The contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. |
Affected by 4 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 5 other vulnerabilities. |
|
VCID-zn73-3dmx-vye4
Aliases: CVE-2026-39365 GHSA-4w7w-66w2-5vf9 |
vite: Vite: Information disclosure via path traversal in dev server's .map request handling |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||