{ "@id": "urn:uuid:dae77325-e835-418f-89a2-26969195a518", "role": "Document Creator", "author": "https://tuxcare.com", "version": 16, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T22:34:00.065751+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 4.5.14-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 4.5.14-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 4.5.14-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 4.5.14-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-49293 affects version 4.5.14-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2023-49293" }, "action_statement": "Vulnerability CVE-2023-49293 affects version 4.5.14-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23331 does not affect version 4.5.14-tuxcare.2 of vite. already_fixed \u2014 The target repository (Vite 4.5.14-tuxcare.1) already contains the fix for CVE-2024-23331. The vulnerability allowed bypassing server.fs.deny restrictions on case-insensitive filesystems by using case-augmented filenames (e.g., .EnV instead of .env). The fix adds nocase: true to the picomatch configuration, enabling case-insensitive glob pattern matching that blocks such bypass attempts.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-23331" }, "impact_statement": "already_fixed \u2014 The target repository (Vite 4.5.14-tuxcare.1) already contains the fix for CVE-2024-23331. The vulnerability allowed bypassing server.fs.deny restrictions on case-insensitive filesystems by using case-augmented filenames (e.g., .EnV instead of .env). The fix adds nocase: true to the picomatch configuration, enabling case-insensitive glob pattern matching that blocks such bypass attempts." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 4.5.14-tuxcare.2 of vite. already_fixed \u2014 CVE-2024-31207 has already been fixed in the target repository. The fix from upstream commit 96a7f3a41 is present at packages/vite/src/node/server/index.ts lines 518-530. The vulnerability (bypass of directory-based fs.deny patterns due to picomatch misconfiguration) was fixed by changing matchBase from true to false, adding dot: true, and normalizing patterns without directory separators.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "already_fixed \u2014 CVE-2024-31207 has already been fixed in the target repository. The fix from upstream commit 96a7f3a41 is present at packages/vite/src/node/server/index.ts lines 518-530. The vulnerability (bypass of directory-based fs.deny patterns due to picomatch misconfiguration) was fixed by changing matchBase from true to false, adding dot: true, and normalizing patterns without directory separators." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45811 does not affect version 4.5.14-tuxcare.2 of vite. already_fixed \u2014 CVE-2024-45811 has been fixed in the target repository. The fix was backported in commit b901438f9 (Sep 16, 2024) and is present in version 4.5.14-tuxcare.1. The current implementation uses deniedServingAccessForTransform to validate access before serving files with raw/url query parameters, preventing unauthorized file access outside the serving allow list.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45811" }, "impact_statement": "already_fixed \u2014 CVE-2024-45811 has been fixed in the target repository. The fix was backported in commit b901438f9 (Sep 16, 2024) and is present in version 4.5.14-tuxcare.1. The current implementation uses deniedServingAccessForTransform to validate access before serving files with raw/url query parameters, preventing unauthorized file access outside the serving allow list." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-11-13T22:34:00.065751+00:00", "status_notes": "Vulnerability CVE-2024-45812 does not affect version 4.5.14-tuxcare.2 of vite. not_affected \u2014 Vite 4.5.14 already contains the upstream fix for CVE-2024-45812 (vitejs/vite #18115). The fix shipped in the upstream release that TuxCare onboarded, so this is not a TuxCare backport. getRelativeUrlFromDocument only trusts document.currentScript.src when its tagName is SCRIPT, so a clobbering img element cannot supply the base URL.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45812" }, "impact_statement": "not_affected \u2014 Vite 4.5.14 already contains the upstream fix for CVE-2024-45812 (vitejs/vite #18115). The fix shipped in the upstream release that TuxCare onboarded, so this is not a TuxCare backport. getRelativeUrlFromDocument only trusts document.currentScript.src when its tagName is SCRIPT, so a clobbering img element cannot supply the base URL." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52011 affects version 4.5.14-tuxcare.2 of vite, and is fixed in 4.5.14-tuxcare.3.", "vulnerability": { "name": "CVE-2024-52011" }, "action_statement": "Vulnerability CVE-2024-52011 affects version 4.5.14-tuxcare.2 of vite, and is fixed in 4.5.14-tuxcare.3." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-24010 does not affect version 4.5.14-tuxcare.2 of vite. already_fixed \u2014 All three CVE-2025-24010 vulnerabilities (permissive CORS, missing WebSocket Origin validation, missing Host header validation) have been fixed in the target repository at commit aa7b8e80132745520acb694f2d65064bd0dfe524. The fixes were applied via commits c065a775d (WebSocket token), ef1049d45 (Host header), and 07b36d503 + 8f63cd66a (CORS restrictions) on 2025-01-20, before the current 4.5.14-...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24010" }, "impact_statement": "already_fixed \u2014 All three CVE-2025-24010 vulnerabilities (permissive CORS, missing WebSocket Origin validation, missing Host header validation) have been fixed in the target repository at commit aa7b8e80132745520acb694f2d65064bd0dfe524. The fixes were applied via commits c065a775d (WebSocket token), ef1049d45 (Host header), and 07b36d503 + 8f63cd66a (CORS restrictions) on 2025-01-20, before the current 4.5.14-..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-11-06T11:25:00.048413+00:00", "status_notes": "Vulnerability CVE-2025-30208 does not affect version 4.5.14-tuxcare.2 of vite. not_affected \u2014 The CVE-2025-30208 fix (upstream vite backport #19704, commit 315695e9d) is already in the target. It shipped inside the upstream 4.5.14 release that TuxCare onboarded, so the vulnerable pattern is not present. The transform middleware strips trailing '?' and '&' separators before the raw/url/inline serving-access check, so '?import&raw??' can no longer bypass the @fs allow-list.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-30208" }, "impact_statement": "not_affected \u2014 The CVE-2025-30208 fix (upstream vite backport #19704, commit 315695e9d) is already in the target. It shipped inside the upstream 4.5.14 release that TuxCare onboarded, so the vulnerable pattern is not present. The transform middleware strips trailing '?' and '&' separators before the raw/url/inline serving-access check, so '?import&raw??' can no longer bypass the @fs allow-list." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-11-06T11:28:00.026983+00:00", "status_notes": "Vulnerability CVE-2025-31125 does not affect version 4.5.14-tuxcare.2 of vite. not_affected \u2014 Not affected. The fix for CVE-2025-31125 is already in the target. The Vite 4.5.14 upstream release runs the fs serving-access check on any request whose URL carries ?raw, ?url, ?inline or .svg before the transform. It runs the check again on the resolved id before load. The fix commit is upstream-authored (patak-dev, 0a3dcf587) and predates the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31125" }, "impact_statement": "not_affected \u2014 Not affected. The fix for CVE-2025-31125 is already in the target. The Vite 4.5.14 upstream release runs the fs serving-access check on any request whose URL carries ?raw, ?url, ?inline or .svg before the transform. It runs the check again on the resolved id before load. The fix commit is upstream-authored (patak-dev, 0a3dcf587) and predates the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-11-06T11:30:06.317055+00:00", "status_notes": "Vulnerability CVE-2025-31486 does not affect version 4.5.14-tuxcare.2 of vite. not_affected \u2014 Not affected. The upstream vite 4.5.x backport of the CVE-2025-31486 fix (commit 0a3dcf587, \"fix: backport #19782, fs check with svg and relative paths\") is already in HEAD. It shipped in the upstream release that TuxCare onboarded, and the author is not a TuxCare identity. All three parts of the fix are present: svg inclusion in the transform-middleware access check, an id-level allowId check ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31486" }, "impact_statement": "not_affected \u2014 Not affected. The upstream vite 4.5.x backport of the CVE-2025-31486 fix (commit 0a3dcf587, \"fix: backport #19782, fs check with svg and relative paths\") is already in HEAD. It shipped in the upstream release that TuxCare onboarded, and the author is not a TuxCare identity. All three parts of the fix are present: svg inclusion in the transform-middleware access check, an id-level allowId check ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-11-06T11:32:00.041448+00:00", "status_notes": "Vulnerability CVE-2025-32395 does not affect version 4.5.14-tuxcare.2 of vite. not_affected \u2014 Not affected. The target (vite 4.5.14) already contains the upstream fix for CVE-2025-32395. It is a rejectInvalidRequest middleware that returns 400 for any request whose req.url contains '#'. The fix was authored upstream (backport #19830/#19832, green@sapphi.red) and shipped in the upstream 4.5.14 release, before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32395" }, "impact_statement": "not_affected \u2014 Not affected. The target (vite 4.5.14) already contains the upstream fix for CVE-2025-32395. It is a rejectInvalidRequest middleware that returns 400 for any request whose req.url contains '#'. The fix was authored upstream (backport #19830/#19832, green@sapphi.red) and shipped in the upstream 4.5.14 release, before the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46565 does not affect version 4.5.14-tuxcare.2 of vite. not_affected \u2014 CVE-2025-46565 affects Vite dev servers that allow bypassing server.fs.deny patterns using `/.` path manipulation (e.g., `/.env/.` to read `.env` files). The target repository at version 4.5.14-tuxcare.3 (SHA 6837a87bb) already contains the upstream fix via commit 7739479d8 \"fix: backport #19965, check static serve file inside sirv (#19967)\". This fix adds validation inside sirv's `shouldServe`...", "vulnerability": { "name": "CVE-2025-46565" }, "impact_statement": "not_affected \u2014 CVE-2025-46565 affects Vite dev servers that allow bypassing server.fs.deny patterns using `/.` path manipulation (e.g., `/.env/.` to read `.env` files). The target repository at version 4.5.14-tuxcare.3 (SHA 6837a87bb) already contains the upstream fix via commit 7739479d8 \"fix: backport #19965, check static serve file inside sirv (#19967)\". This fix adds validation inside sirv's `shouldServe`..." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58751 is fixed in version 4.5.14-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2025-58751" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58752 is fixed in version 4.5.14-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2025-58752" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62522 is fixed in version 4.5.14-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2025-62522" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-11-06T13:34:00.050639+00:00", "status_notes": "Vulnerability CVE-2026-112942 does not affect version 4.5.14-tuxcare.2 of vite. Not affected launch-editor existence-check bypass (Windows). fs.existsSync ran on name with `:line:col` only stripped, not resolved, so `\\..:1:1` passed as existing parent dir and reached the cmd.exe command. Already covered: vite bundles launch-editor(-middleware) 2.14.2 since 8754c61b2 (deps bump). 2.14.2 has upstream fix vitejs/launch-editor f13cd83: strip position, path.resolve, then UNC + existence check. No code change on this line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112942" }, "impact_statement": "Not affected launch-editor existence-check bypass (Windows). fs.existsSync ran on name with `:line:col` only stripped, not resolved, so `\\..:1:1` passed as existing parent dir and reached the cmd.exe command. Already covered: vite bundles launch-editor(-middleware) 2.14.2 since 8754c61b2 (deps bump). 2.14.2 has upstream fix vitejs/launch-editor f13cd83: strip position, path.resolve, then UNC + existence check. No code change on this line." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-11-06T13:34:00.050639+00:00", "status_notes": "Vulnerability CVE-2026-112943 does not affect version 4.5.14-tuxcare.2 of vite. Not affected launch-editor cmd.exe injection (Windows). Launch command built from file name without rejecting `%` or line breaks, so cmd.exe expands %VAR% / %VAR:old=new% and a CR/LF splits off a new command. Already covered: vite bundles launch-editor(-middleware) 2.14.2 since 8754c61b2 (deps bump). 2.14.2 has upstream fix vitejs/launch-editor 3c2f9bf (#155): constructWindowsLaunchCommand rejects `%` and CR/LF; error goes to onErrorCallback, no editor launched. No code change on this line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112943" }, "impact_statement": "Not affected launch-editor cmd.exe injection (Windows). Launch command built from file name without rejecting `%` or line breaks, so cmd.exe expands %VAR% / %VAR:old=new% and a CR/LF splits off a new command. Already covered: vite bundles launch-editor(-middleware) 2.14.2 since 8754c61b2 (deps bump). 2.14.2 has upstream fix vitejs/launch-editor 3c2f9bf (#155): constructWindowsLaunchCommand rejects `%` and CR/LF; error goes to onErrorCallback, no editor launched. No code change on this line." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-11-06T13:34:00.050639+00:00", "status_notes": "Vulnerability CVE-2026-112944 does not affect version 4.5.14-tuxcare.2 of vite. Not affected launch-editor file name taken as editor flag. On WSL the name went to the editor as bare relative path, so a `+`/`-` entry was read as option/command (Vim `+`, `-` flags in Vim/MacVim/Emacs, Notepad++ only with a plugin exposing dangerous plugin messages). Vite reachable on WSL only: middleware absolutizes `file`, WSL branch made it relative again. Already covered: vite bundles launch-editor(-middleware) 2.14.2 since 8754c61b2 (deps bump). 2.14.2 has upstream fix vitejs/launch-editor f6e6701 (#156): get-args resolves path first and prefixes `./` on the WSL relative path. No code change on this line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112944" }, "impact_statement": "Not affected launch-editor file name taken as editor flag. On WSL the name went to the editor as bare relative path, so a `+`/`-` entry was read as option/command (Vim `+`, `-` flags in Vim/MacVim/Emacs, Notepad++ only with a plugin exposing dangerous plugin messages). Vite reachable on WSL only: middleware absolutizes `file`, WSL branch made it relative again. Already covered: vite bundles launch-editor(-middleware) 2.14.2 since 8754c61b2 (deps bump). 2.14.2 has upstream fix vitejs/launch-editor f6e6701 (#156): get-args resolves path first and prefixes `./` on the WSL relative path. No code change on this line." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-10-27T11:10:14.450797+00:00", "status_notes": "Vulnerability CVE-2026-112945 affects version 4.5.14-tuxcare.2 of vite, and is fixed in 4.5.14-tuxcare.6.", "vulnerability": { "name": "CVE-2026-112945" }, "action_statement": "Vulnerability CVE-2026-112945 affects version 4.5.14-tuxcare.2 of vite, and is fixed in 4.5.14-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-10-27T11:10:14.450797+00:00", "status_notes": "Vulnerability CVE-2026-112946 affects version 4.5.14-tuxcare.2 of vite, and is fixed in 4.5.14-tuxcare.6.", "vulnerability": { "name": "CVE-2026-112946" }, "action_statement": "Vulnerability CVE-2026-112946 affects version 4.5.14-tuxcare.2 of vite, and is fixed in 4.5.14-tuxcare.6." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-11-04T02:58:06.245145+00:00", "status_notes": "Vulnerability CVE-2026-112947 does not affect version 4.5.14-tuxcare.2 of vite. not_affected \u2014 Version 4.5.14 is NOT AFFECTED by CVE-2026-112947. The vulnerability requires server-side code that processes the `?vite-wasm-instance` query parameter to read files from disk and attempt WebAssembly parsing, leaking file content through error messages. This code path does NOT exist in version 4.5.14. The wasm plugin only handles `.wasm?init` patterns (packages/vite/src/node/plugins/wasm.ts:66)...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112947" }, "impact_statement": "not_affected \u2014 Version 4.5.14 is NOT AFFECTED by CVE-2026-112947. The vulnerability requires server-side code that processes the `?vite-wasm-instance` query parameter to read files from disk and attempt WebAssembly parsing, leaking file content through error messages. This code path does NOT exist in version 4.5.14. The wasm plugin only handles `.wasm?init` patterns (packages/vite/src/node/plugins/wasm.ts:66)..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-10-29T16:45:45.459074+00:00", "status_notes": "Vulnerability CVE-2026-118662 affects version 4.5.14-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-118662" }, "action_statement": "Vulnerability CVE-2026-118662 affects version 4.5.14-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39363 does not affect version 4.5.14-tuxcare.2 of vite. not_affected \u2014 Vite 4.5.14 is not affected by CVE-2026-39363. The vulnerability describes a WebSocket fetchModule API that bypasses server.fs access controls, but this API does not exist in version 4.5.14. The fetchModule feature was introduced 1,481 commits later in Vite 6.0.0-beta.9. The target version's WebSocket implementation only supports HMR payloads and a single custom event (vite:invalidate) for modu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39363" }, "impact_statement": "not_affected \u2014 Vite 4.5.14 is not affected by CVE-2026-39363. The vulnerability describes a WebSocket fetchModule API that bypasses server.fs access controls, but this API does not exist in version 4.5.14. The fetchModule feature was introduced 1,481 commits later in Vite 6.0.0-beta.9. The target version's WebSocket implementation only supports HMR payloads and a single custom event (vite:invalidate) for modu..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39364 does not affect version 4.5.14-tuxcare.2 of vite. not_affected \u2014 The target Vite version 4.5.14 is not affected by CVE-2026-39364. The vulnerability exists in versions 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4, where a code refactoring introduced a flaw allowing server.fs.deny bypass via query parameters. Version 4.5.14 uses a different architectural approach that includes query parameter stripping before access control checks, preventing the attack.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39364" }, "impact_statement": "not_affected \u2014 The target Vite version 4.5.14 is not affected by CVE-2026-39364. The vulnerability exists in versions 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4, where a code refactoring introduced a flaw allowing server.fs.deny bypass via query parameters. Version 4.5.14 uses a different architectural approach that includes query parameter stripping before access control checks, preventing the attack." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39365 is fixed in version 4.5.14-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-39365" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53571 affects version 4.5.14-tuxcare.2 of vite, and is fixed in 4.5.14-tuxcare.3.", "vulnerability": { "name": "CVE-2026-53571" }, "action_statement": "Vulnerability CVE-2026-53571 affects version 4.5.14-tuxcare.2 of vite, and is fixed in 4.5.14-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.14-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.14-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53632 affects version 4.5.14-tuxcare.2 of vite, and is fixed in 4.5.14-tuxcare.3.", "vulnerability": { "name": "CVE-2026-53632" }, "action_statement": "Vulnerability CVE-2026-53632 affects version 4.5.14-tuxcare.2 of vite, and is fixed in 4.5.14-tuxcare.3." } ] }