vitejs has 4 CVEs on record between 2025 and 2026. 1 was published in the last 90 days. The median CVSS is 7.5 (high). Most affected products: vite (3), launch-editor (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 1 prev 0
Weakness classes
Products
- vite 3
- launch-editor 1
Worst active — by depth score
CVE-2026-39364High· 7.5Vite is a frontend tooling framework for JavaScript54CVE-2026-39363High· 7.5Vite is a frontend tooling framework for JavaScript54CVE-2026-112942High· 7.5launch-editor: `fs.existsSync()` existence check can be bypassed on Windows42CVE-2025-58752Medium· 5.3Vite is a frontend tooling framework for JavaScript29
vitejs vulnerabilities
CVEs affecting vitejs, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-112942High· 7.5launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory compon…
CVE-2026-39364High· 7.5PoCVite is a frontend tooling framework for JavaScript
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query par…
CVE-2026-39363High· 7.5PoCVite is a frontend tooling framework for JavaScript
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custo…
CVE-2025-58752Medium· 5.3Vite is a frontend tooling framework for JavaScript
Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev serve…