| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-53we-mdcx-bbfr |
| vulnerability_id |
VCID-53we-mdcx-bbfr |
| summary |
Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to `cjs`/`iife`/`umd` output format. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present. DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. We have identified a DOM Clobbering vulnerability in Vite bundled scripts, particularly when the scripts dynamically import other scripts from the assets folder and the developer sets the build output format to `cjs`, `iife`, or `umd`. In such cases, Vite replaces relative paths starting with `__VITE_ASSET__` using the URL retrieved from `document.currentScript`. However, this implementation is vulnerable to a DOM Clobbering attack. The `document.currentScript` lookup can be shadowed by an attacker via the browser's named DOM tree element access mechanism. This manipulation allows an attacker to replace the intended script element with a malicious HTML element. When this happens, the src attribute of the attacker-controlled element is used as the URL for importing scripts, potentially leading to the dynamic loading of scripts from an attacker-controlled server. This vulnerability can result in cross-site scripting (XSS) attacks on websites that include Vite-bundled files (configured with an output format of `cjs`, `iife`, or `umd`) and allow users to inject certain scriptless HTML tags without properly sanitizing the name or id attributes. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-45812 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00256 |
| scoring_system |
epss |
| scoring_elements |
0.49432 |
| published_at |
2026-06-14T12:55:00Z |
|
| 1 |
| value |
0.00256 |
| scoring_system |
epss |
| scoring_elements |
0.49444 |
| published_at |
2026-06-13T12:55:00Z |
|
| 2 |
| value |
0.00256 |
| scoring_system |
epss |
| scoring_elements |
0.49426 |
| published_at |
2026-06-12T12:55:00Z |
|
| 3 |
| value |
0.00256 |
| scoring_system |
epss |
| scoring_elements |
0.49289 |
| published_at |
2026-06-11T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-45812 |
|
| 2 |
| reference_url |
https://github.com/vitejs/vite |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.4 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H |
|
| 1 |
| value |
4.8 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/vitejs/vite |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
| reference_url |
https://scnps.co/papers/sp23_domclob.pdf |
| reference_id |
sp23_domclob.pdf |
| reference_type |
|
| scores |
| 0 |
| value |
6.4 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H |
|
| 1 |
| value |
4.8 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 3 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-18T13:57:07Z/ |
|
|
| url |
https://scnps.co/papers/sp23_domclob.pdf |
|
| 17 |
|
|
| fixed_packages |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| url |
pkg:npm/vite@4.5.5 |
| purl |
pkg:npm/vite@4.5.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-6mrd-hwmy-4yay |
|
| 1 |
| vulnerability |
VCID-84n3-jwnn-6kc4 |
|
| 2 |
| vulnerability |
VCID-bn49-7c61-27fp |
|
| 3 |
| vulnerability |
VCID-g8z2-qvuv-b7da |
|
| 4 |
| vulnerability |
VCID-h2jq-e6kt-v3f9 |
|
| 5 |
| vulnerability |
VCID-h3c2-mbd1-zua6 |
|
| 6 |
| vulnerability |
VCID-nh6q-ms28-13ee |
|
| 7 |
| vulnerability |
VCID-w4t6-jjc1-afac |
|
| 8 |
| vulnerability |
VCID-xrg5-ae14-c3e1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vite@4.5.5 |
|
| 4 |
| url |
pkg:npm/vite@5.1.8 |
| purl |
pkg:npm/vite@5.1.8 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-6mrd-hwmy-4yay |
|
| 1 |
| vulnerability |
VCID-84n3-jwnn-6kc4 |
|
| 2 |
| vulnerability |
VCID-bn49-7c61-27fp |
|
| 3 |
| vulnerability |
VCID-g8z2-qvuv-b7da |
|
| 4 |
| vulnerability |
VCID-h2jq-e6kt-v3f9 |
|
| 5 |
| vulnerability |
VCID-h3c2-mbd1-zua6 |
|
| 6 |
| vulnerability |
VCID-nh6q-ms28-13ee |
|
| 7 |
| vulnerability |
VCID-w4t6-jjc1-afac |
|
| 8 |
| vulnerability |
VCID-xrg5-ae14-c3e1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vite@5.1.8 |
|
| 5 |
|
| 6 |
|
| 7 |
| url |
pkg:npm/vite@5.3.6 |
| purl |
pkg:npm/vite@5.3.6 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-6mrd-hwmy-4yay |
|
| 1 |
| vulnerability |
VCID-84n3-jwnn-6kc4 |
|
| 2 |
| vulnerability |
VCID-bn49-7c61-27fp |
|
| 3 |
| vulnerability |
VCID-g8z2-qvuv-b7da |
|
| 4 |
| vulnerability |
VCID-h2jq-e6kt-v3f9 |
|
| 5 |
| vulnerability |
VCID-h3c2-mbd1-zua6 |
|
| 6 |
| vulnerability |
VCID-nh6q-ms28-13ee |
|
| 7 |
| vulnerability |
VCID-w4t6-jjc1-afac |
|
| 8 |
| vulnerability |
VCID-xrg5-ae14-c3e1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vite@5.3.6 |
|
| 8 |
| url |
pkg:npm/vite@5.4.6 |
| purl |
pkg:npm/vite@5.4.6 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-6mrd-hwmy-4yay |
|
| 1 |
| vulnerability |
VCID-84n3-jwnn-6kc4 |
|
| 2 |
| vulnerability |
VCID-bn49-7c61-27fp |
|
| 3 |
| vulnerability |
VCID-g8z2-qvuv-b7da |
|
| 4 |
| vulnerability |
VCID-h2jq-e6kt-v3f9 |
|
| 5 |
| vulnerability |
VCID-h3c2-mbd1-zua6 |
|
| 6 |
| vulnerability |
VCID-nh6q-ms28-13ee |
|
| 7 |
| vulnerability |
VCID-w4t6-jjc1-afac |
|
| 8 |
| vulnerability |
VCID-xrg5-ae14-c3e1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vite@5.4.6 |
|
|
| aliases |
CVE-2024-45812, GHSA-64vr-g452-qvp3
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-53we-mdcx-bbfr |
|
| 1 |
| url |
VCID-6mrd-hwmy-4yay |
| vulnerability_id |
VCID-6mrd-hwmy-4yay |
| summary |
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-31125, GHSA-4r4m-qw57-chr8
|
| risk_score |
10.0 |
| exploitability |
2.0 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6mrd-hwmy-4yay |
|
| 2 |
| url |
VCID-84n3-jwnn-6kc4 |
| vulnerability_id |
VCID-84n3-jwnn-6kc4 |
| summary |
Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2025-31486 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.04736 |
| scoring_system |
epss |
| scoring_elements |
0.89648 |
| published_at |
2026-06-11T12:55:00Z |
|
| 1 |
| value |
0.04736 |
| scoring_system |
epss |
| scoring_elements |
0.89688 |
| published_at |
2026-06-14T12:55:00Z |
|
| 2 |
| value |
0.04736 |
| scoring_system |
epss |
| scoring_elements |
0.89683 |
| published_at |
2026-06-12T12:55:00Z |
|
| 3 |
| value |
0.04736 |
| scoring_system |
epss |
| scoring_elements |
0.89689 |
| published_at |
2026-06-13T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2025-31486 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-31486, GHSA-xcj6-pq6g-qj4x
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-84n3-jwnn-6kc4 |
|
| 3 |
| url |
VCID-bn49-7c61-27fp |
| vulnerability_id |
VCID-bn49-7c61-27fp |
| summary |
Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. `server.fs.deny` can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under `root` by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2025-46565 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.02428 |
| scoring_system |
epss |
| scoring_elements |
0.85523 |
| published_at |
2026-06-12T12:55:00Z |
|
| 1 |
| value |
0.02428 |
| scoring_system |
epss |
| scoring_elements |
0.85472 |
| published_at |
2026-06-11T12:55:00Z |
|
| 2 |
| value |
0.02588 |
| scoring_system |
epss |
| scoring_elements |
0.85971 |
| published_at |
2026-06-13T12:55:00Z |
|
| 3 |
| value |
0.02588 |
| scoring_system |
epss |
| scoring_elements |
0.85963 |
| published_at |
2026-06-14T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2025-46565 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-46565, GHSA-859w-5945-r5v3
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-bn49-7c61-27fp |
|
| 4 |
| url |
VCID-g8z2-qvuv-b7da |
| vulnerability_id |
VCID-g8z2-qvuv-b7da |
| summary |
Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulnerability is fixed in 6.0.9, 5.4.12, and 4.5.6. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2025-24010 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00125 |
| scoring_system |
epss |
| scoring_elements |
0.31426 |
| published_at |
2026-06-13T12:55:00Z |
|
| 1 |
| value |
0.00125 |
| scoring_system |
epss |
| scoring_elements |
0.31408 |
| published_at |
2026-06-14T12:55:00Z |
|
| 2 |
| value |
0.00125 |
| scoring_system |
epss |
| scoring_elements |
0.31215 |
| published_at |
2026-06-11T12:55:00Z |
|
| 3 |
| value |
0.00125 |
| scoring_system |
epss |
| scoring_elements |
0.31409 |
| published_at |
2026-06-12T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2025-24010 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
| 0 |
|
| 1 |
|
| 2 |
| url |
pkg:npm/vite@6.0.9 |
| purl |
pkg:npm/vite@6.0.9 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-6mrd-hwmy-4yay |
|
| 1 |
| vulnerability |
VCID-84n3-jwnn-6kc4 |
|
| 2 |
| vulnerability |
VCID-bn49-7c61-27fp |
|
| 3 |
| vulnerability |
VCID-h2jq-e6kt-v3f9 |
|
| 4 |
| vulnerability |
VCID-h3c2-mbd1-zua6 |
|
| 5 |
| vulnerability |
VCID-nh6q-ms28-13ee |
|
| 6 |
| vulnerability |
VCID-w4t6-jjc1-afac |
|
| 7 |
| vulnerability |
VCID-xn8m-3ck8-fufm |
|
| 8 |
| vulnerability |
VCID-xrg5-ae14-c3e1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vite@6.0.9 |
|
|
| aliases |
CVE-2025-24010, GHSA-vg6x-rcgg-rjx6
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-g8z2-qvuv-b7da |
|
| 5 |
| url |
VCID-h2jq-e6kt-v3f9 |
| vulnerability_id |
VCID-h2jq-e6kt-v3f9 |
| summary |
Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: 'spa'` (default) or `appType: 'mpa'` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-58752, GHSA-jqfw-vq24-v9c3
|
| risk_score |
1.6 |
| exploitability |
0.5 |
| weighted_severity |
3.3 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-h2jq-e6kt-v3f9 |
|
| 6 |
| url |
VCID-h3c2-mbd1-zua6 |
| vulnerability_id |
VCID-h3c2-mbd1-zua6 |
| summary |
Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2025-58751 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01434 |
| scoring_system |
epss |
| scoring_elements |
0.81166 |
| published_at |
2026-06-14T12:55:00Z |
|
| 1 |
| value |
0.01434 |
| scoring_system |
epss |
| scoring_elements |
0.81167 |
| published_at |
2026-06-12T12:55:00Z |
|
| 2 |
| value |
0.01434 |
| scoring_system |
epss |
| scoring_elements |
0.81108 |
| published_at |
2026-06-11T12:55:00Z |
|
| 3 |
| value |
0.01434 |
| scoring_system |
epss |
| scoring_elements |
0.81176 |
| published_at |
2026-06-13T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2025-58751 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-58751, GHSA-g4jq-h2w9-997c
|
| risk_score |
1.6 |
| exploitability |
0.5 |
| weighted_severity |
3.3 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-h3c2-mbd1-zua6 |
|
| 7 |
| url |
VCID-jhy2-cnvt-nyg1 |
| vulnerability_id |
VCID-jhy2-cnvt-nyg1 |
| summary |
Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-45811 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.03076 |
| published_at |
2026-06-14T12:55:00Z |
|
| 1 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.03064 |
| published_at |
2026-06-13T12:55:00Z |
|
| 2 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.03081 |
| published_at |
2026-06-12T12:55:00Z |
|
| 3 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.03068 |
| published_at |
2026-06-11T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-45811 |
|
| 2 |
| reference_url |
https://github.com/vitejs/vite |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/vitejs/vite |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
| reference_url |
https://github.com/vitejs/vite/security/advisories/GHSA-9cwx-2883-4wfx |
| reference_id |
GHSA-9cwx-2883-4wfx |
| reference_type |
|
| scores |
| 0 |
| value |
4.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 3 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 4 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 5 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-18T13:59:58Z/ |
|
|
| url |
https://github.com/vitejs/vite/security/advisories/GHSA-9cwx-2883-4wfx |
|
| 12 |
|
| 13 |
|
|
| fixed_packages |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| url |
pkg:npm/vite@4.5.5 |
| purl |
pkg:npm/vite@4.5.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-6mrd-hwmy-4yay |
|
| 1 |
| vulnerability |
VCID-84n3-jwnn-6kc4 |
|
| 2 |
| vulnerability |
VCID-bn49-7c61-27fp |
|
| 3 |
| vulnerability |
VCID-g8z2-qvuv-b7da |
|
| 4 |
| vulnerability |
VCID-h2jq-e6kt-v3f9 |
|
| 5 |
| vulnerability |
VCID-h3c2-mbd1-zua6 |
|
| 6 |
| vulnerability |
VCID-nh6q-ms28-13ee |
|
| 7 |
| vulnerability |
VCID-w4t6-jjc1-afac |
|
| 8 |
| vulnerability |
VCID-xrg5-ae14-c3e1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vite@4.5.5 |
|
| 4 |
| url |
pkg:npm/vite@5.1.8 |
| purl |
pkg:npm/vite@5.1.8 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-6mrd-hwmy-4yay |
|
| 1 |
| vulnerability |
VCID-84n3-jwnn-6kc4 |
|
| 2 |
| vulnerability |
VCID-bn49-7c61-27fp |
|
| 3 |
| vulnerability |
VCID-g8z2-qvuv-b7da |
|
| 4 |
| vulnerability |
VCID-h2jq-e6kt-v3f9 |
|
| 5 |
| vulnerability |
VCID-h3c2-mbd1-zua6 |
|
| 6 |
| vulnerability |
VCID-nh6q-ms28-13ee |
|
| 7 |
| vulnerability |
VCID-w4t6-jjc1-afac |
|
| 8 |
| vulnerability |
VCID-xrg5-ae14-c3e1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vite@5.1.8 |
|
| 5 |
|
| 6 |
|
| 7 |
| url |
pkg:npm/vite@5.3.6 |
| purl |
pkg:npm/vite@5.3.6 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-6mrd-hwmy-4yay |
|
| 1 |
| vulnerability |
VCID-84n3-jwnn-6kc4 |
|
| 2 |
| vulnerability |
VCID-bn49-7c61-27fp |
|
| 3 |
| vulnerability |
VCID-g8z2-qvuv-b7da |
|
| 4 |
| vulnerability |
VCID-h2jq-e6kt-v3f9 |
|
| 5 |
| vulnerability |
VCID-h3c2-mbd1-zua6 |
|
| 6 |
| vulnerability |
VCID-nh6q-ms28-13ee |
|
| 7 |
| vulnerability |
VCID-w4t6-jjc1-afac |
|
| 8 |
| vulnerability |
VCID-xrg5-ae14-c3e1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vite@5.3.6 |
|
| 8 |
| url |
pkg:npm/vite@5.4.6 |
| purl |
pkg:npm/vite@5.4.6 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-6mrd-hwmy-4yay |
|
| 1 |
| vulnerability |
VCID-84n3-jwnn-6kc4 |
|
| 2 |
| vulnerability |
VCID-bn49-7c61-27fp |
|
| 3 |
| vulnerability |
VCID-g8z2-qvuv-b7da |
|
| 4 |
| vulnerability |
VCID-h2jq-e6kt-v3f9 |
|
| 5 |
| vulnerability |
VCID-h3c2-mbd1-zua6 |
|
| 6 |
| vulnerability |
VCID-nh6q-ms28-13ee |
|
| 7 |
| vulnerability |
VCID-w4t6-jjc1-afac |
|
| 8 |
| vulnerability |
VCID-xrg5-ae14-c3e1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vite@5.4.6 |
|
|
| aliases |
CVE-2024-45811, GHSA-9cwx-2883-4wfx
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jhy2-cnvt-nyg1 |
|
| 8 |
| url |
VCID-nh6q-ms28-13ee |
| vulnerability_id |
VCID-nh6q-ms28-13ee |
| summary |
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-39365 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01457 |
| scoring_system |
epss |
| scoring_elements |
0.81253 |
| published_at |
2026-06-11T12:55:00Z |
|
| 1 |
| value |
0.01457 |
| scoring_system |
epss |
| scoring_elements |
0.81321 |
| published_at |
2026-06-13T12:55:00Z |
|
| 2 |
| value |
0.01457 |
| scoring_system |
epss |
| scoring_elements |
0.81313 |
| published_at |
2026-06-12T12:55:00Z |
|
| 3 |
| value |
0.01521 |
| scoring_system |
epss |
| scoring_elements |
0.81719 |
| published_at |
2026-06-14T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-39365 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-39365, GHSA-4w7w-66w2-5vf9
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-nh6q-ms28-13ee |
|
| 9 |
|
| 10 |
| url |
VCID-wf6g-h5dq-1qg3 |
| vulnerability_id |
VCID-wf6g-h5dq-1qg3 |
| summary |
Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2022-35204 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.0097 |
| scoring_system |
epss |
| scoring_elements |
0.77119 |
| published_at |
2026-06-12T12:55:00Z |
|
| 1 |
| value |
0.0097 |
| scoring_system |
epss |
| scoring_elements |
0.77048 |
| published_at |
2026-06-11T12:55:00Z |
|
| 2 |
| value |
0.0097 |
| scoring_system |
epss |
| scoring_elements |
0.77125 |
| published_at |
2026-06-14T12:55:00Z |
|
| 3 |
| value |
0.0097 |
| scoring_system |
epss |
| scoring_elements |
0.77131 |
| published_at |
2026-06-13T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2022-35204 |
|
| 1 |
| reference_url |
https://github.com/vitejs/vite |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.6 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/vitejs/vite |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/vite@3.0.0-beta.4 |
| purl |
pkg:npm/vite@3.0.0-beta.4 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-53we-mdcx-bbfr |
|
| 1 |
| vulnerability |
VCID-6mrd-hwmy-4yay |
|
| 2 |
| vulnerability |
VCID-84n3-jwnn-6kc4 |
|
| 3 |
| vulnerability |
VCID-bn49-7c61-27fp |
|
| 4 |
| vulnerability |
VCID-g8z2-qvuv-b7da |
|
| 5 |
| vulnerability |
VCID-h2jq-e6kt-v3f9 |
|
| 6 |
| vulnerability |
VCID-h3c2-mbd1-zua6 |
|
| 7 |
| vulnerability |
VCID-jhy2-cnvt-nyg1 |
|
| 8 |
| vulnerability |
VCID-nh6q-ms28-13ee |
|
| 9 |
| vulnerability |
VCID-w4t6-jjc1-afac |
|
| 10 |
| vulnerability |
VCID-xrg5-ae14-c3e1 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vite@3.0.0-beta.4 |
|
|
| aliases |
CVE-2022-35204, GHSA-mv48-hcvh-8jj8
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wf6g-h5dq-1qg3 |
|
| 11 |
| url |
VCID-xrg5-ae14-c3e1 |
| vulnerability_id |
VCID-xrg5-ae14-c3e1 |
| summary |
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-30208, GHSA-x574-m823-4x7w
|
| risk_score |
10.0 |
| exploitability |
2.0 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-xrg5-ae14-c3e1 |
|
|
|---|