vite-plus vulnerabilities

CVEs whose affected-version data names the vite-plus package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

10 CVEsRSS

CVE-2026-112945Low· 2.1

6d ago

Vite: Cross origin script execution through Vite custom middleware

▾ Sunlitvite · viteEPSS 0.56%via GHSA

CVE-2026-112946Medium· 6.3PoC

6d ago

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

▾ Twilightvite · viteEPSS 0.85%via GHSA

CVE-2026-112947Medium· 6.3

6d ago

Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

▾ Sunlitvite · viteEPSS 0.50%via GHSA

CVE-2026-112948Medium· 6.5

6d ago

Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

▾ Sunlitvitest · @vitest/uiEPSS 0.40%via GHSA

CVE-2026-112942High· 7.5

1w ago

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory compon…

▾ Twilightvitejs · launch-editorEPSS 1.3%via CVEORG

CVE-2026-112943Medium· 6.3

1w ago