{ "@id": "urn:uuid:62f69fec-1d21-490a-a5d3-4352d6ab88a4", "role": "Document Creator", "author": "https://tuxcare.com", "version": 18, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:45:53.329042+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 4.5.5-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 4.5.5-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 4.5.5-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 4.5.5-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-11-14T02:45:53.329042+00:00", "status_notes": "Vulnerability CVE-2023-49293 does not affect version 4.5.5-tuxcare.2 of vite. not_affected \u2014 Vite 4.5.5 already contains the upstream fix for CVE-2023-49293. The vulnerable `htmlPath = decodeURI(htmlPath)` in devHtmlHook (introduced by #13581) is gone, and the raw URL stays percent-encoded when embedded in the html-proxy script src. The fix is upstream commit 41bb3546a (#15226), which is in the upstream release TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49293" }, "impact_statement": "not_affected \u2014 Vite 4.5.5 already contains the upstream fix for CVE-2023-49293. The vulnerable `htmlPath = decodeURI(htmlPath)` in devHtmlHook (introduced by #13581) is gone, and the raw URL stays percent-encoded when embedded in the html-proxy script src. The fix is upstream commit 41bb3546a (#15226), which is in the upstream release TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23331 does not affect version 4.5.5-tuxcare.2 of vite. Version 4.5.5 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-23331. The fix (adding 'nocase: true' to picomatch options) has been applied and is present in the current codebase.", "vulnerability": { "name": "CVE-2024-23331" }, "impact_statement": "Version 4.5.5 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-23331. The fix (adding 'nocase: true' to picomatch options) has been applied and is present in the current codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 4.5.5-tuxcare.2 of vite. not_affected - CVE-2024-31207 (server.fs.deny bypass for patterns containing directories) was fixed upstream in vite 5.2.6 / 5.1.7 / 5.0.13 / 4.5.3 / 3.2.10 / 2.9.18. This project version is vite 4.5.5, i.e. above the 4.5.3 fix in the same 4.5.x line, so the fix is already present and no patch is needed. The previous patch_application_error state came from the automation's pre-validation reporting 'Patches already applied'.", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "not_affected - CVE-2024-31207 (server.fs.deny bypass for patterns containing directories) was fixed upstream in vite 5.2.6 / 5.1.7 / 5.0.13 / 4.5.3 / 3.2.10 / 2.9.18. This project version is vite 4.5.5, i.e. above the 4.5.3 fix in the same 4.5.x line, so the fix is already present and no patch is needed. The previous patch_application_error state came from the automation's pre-validation reporting 'Patches already applied'." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45811 does not affect version 4.5.5-tuxcare.2 of vite. Version 4.5.5 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-45811. The fix is present in a semantically equivalent form, using `checkServingAccess` with `deniedServingAccessForTransform` instead of the vendor's `ensureServingAccess`, but providing identical protection against the ?import&raw bypass vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45811" }, "impact_statement": "Version 4.5.5 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-45811. The fix is present in a semantically equivalent form, using `checkServingAccess` with `deniedServingAccessForTransform` instead of the vendor's `ensureServingAccess`, but providing identical protection against the ?import&raw bypass vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-11-13T22:32:41.845963+00:00", "status_notes": "Vulnerability CVE-2024-45812 does not affect version 4.5.5-tuxcare.2 of vite. not_affected \u2014 Vite 4.5.5 already contains the upstream DOM Clobbering fix for CVE-2024-45812 in getRelativeUrlFromDocument (packages/vite/src/node/build.ts:1099-1104). The generated code only trusts document.currentScript.src when document.currentScript.tagName.toUpperCase() === 'SCRIPT'. Otherwise it falls back to document.baseURI. The fix is upstream commit e8127166 (#18115), authored by thisiszhengyu@gmai...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45812" }, "impact_statement": "not_affected \u2014 Vite 4.5.5 already contains the upstream DOM Clobbering fix for CVE-2024-45812 in getRelativeUrlFromDocument (packages/vite/src/node/build.ts:1099-1104). The generated code only trusts document.currentScript.src when document.currentScript.tagName.toUpperCase() === 'SCRIPT'. Otherwise it falls back to document.baseURI. The fix is upstream commit e8127166 (#18115), authored by thisiszhengyu@gmai..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52011 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.9.", "vulnerability": { "name": "CVE-2024-52011" }, "action_statement": "Vulnerability CVE-2024-52011 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.9." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-24010 is fixed in version 4.5.5-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2025-24010" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-30208 is fixed in version 4.5.5-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2025-30208" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31125 is fixed in version 4.5.5-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2025-31125" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-31486 is fixed in version 4.5.5-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2025-31486" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32395 is fixed in version 4.5.5-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2025-32395" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-10-23T14:08:13.743454+00:00", "status_notes": "Vulnerability CVE-2025-46565 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.10.", "vulnerability": { "name": "CVE-2025-46565" }, "action_statement": "Vulnerability CVE-2025-46565 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.10." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58751 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.9.", "vulnerability": { "name": "CVE-2025-58751" }, "action_statement": "Vulnerability CVE-2025-58751 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.9." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58752 is fixed in version 4.5.5-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2025-58752" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62522 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.7.", "vulnerability": { "name": "CVE-2025-62522" }, "action_statement": "Vulnerability CVE-2025-62522 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-11-06T15:02:00.453910+00:00", "status_notes": "Vulnerability CVE-2026-112942 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.11.", "vulnerability": { "name": "CVE-2026-112942" }, "action_statement": "Vulnerability CVE-2026-112942 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.11." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-11-06T14:48:00.048187+00:00", "status_notes": "Vulnerability CVE-2026-112943 does not affect version 4.5.5-tuxcare.2 of vite. Not affected launch-editor cmd.exe injection (Windows). Launch command built from file name without rejecting `%` or line breaks, so cmd.exe expands %VAR% / %VAR:old=new% and a CR/LF splits off a new command. Already covered: vite bundles launch-editor(-middleware) 2.14.2 since 2915fe905 (deps bump). 2.14.2 has upstream fix vitejs/launch-editor 3c2f9bf (#155): constructWindowsLaunchCommand rejects `%` and CR/LF; error goes to onErrorCallback, no editor launched. No code change on this line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112943" }, "impact_statement": "Not affected launch-editor cmd.exe injection (Windows). Launch command built from file name without rejecting `%` or line breaks, so cmd.exe expands %VAR% / %VAR:old=new% and a CR/LF splits off a new command. Already covered: vite bundles launch-editor(-middleware) 2.14.2 since 2915fe905 (deps bump). 2.14.2 has upstream fix vitejs/launch-editor 3c2f9bf (#155): constructWindowsLaunchCommand rejects `%` and CR/LF; error goes to onErrorCallback, no editor launched. No code change on this line." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-11-06T14:48:00.048187+00:00", "status_notes": "Vulnerability CVE-2026-112944 does not affect version 4.5.5-tuxcare.2 of vite. Not affected launch-editor file name taken as editor flag. On WSL the name went to the editor as bare relative path, so a `+`/`-` entry was read as option/command (Vim `+`, `-` flags in Vim/MacVim/Emacs, Notepad++ only with a plugin exposing dangerous plugin messages). Vite reachable on WSL only: middleware absolutizes `file`, WSL branch made it relative again. Already covered: vite bundles launch-editor(-middleware) 2.14.2 since 2915fe905 (deps bump). 2.14.2 has upstream fix vitejs/launch-editor f6e6701 (#156): get-args resolves path first and prefixes `./` on the WSL relative path. No code change on this line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112944" }, "impact_statement": "Not affected launch-editor file name taken as editor flag. On WSL the name went to the editor as bare relative path, so a `+`/`-` entry was read as option/command (Vim `+`, `-` flags in Vim/MacVim/Emacs, Notepad++ only with a plugin exposing dangerous plugin messages). Vite reachable on WSL only: middleware absolutizes `file`, WSL branch made it relative again. Already covered: vite bundles launch-editor(-middleware) 2.14.2 since 2915fe905 (deps bump). 2.14.2 has upstream fix vitejs/launch-editor f6e6701 (#156): get-args resolves path first and prefixes `./` on the WSL relative path. No code change on this line." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-11-06T15:02:12.881248+00:00", "status_notes": "Vulnerability CVE-2026-112945 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.11.", "vulnerability": { "name": "CVE-2026-112945" }, "action_statement": "Vulnerability CVE-2026-112945 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.11." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-11-10T10:28:53.823837+00:00", "status_notes": "Vulnerability CVE-2026-112946 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.12.", "vulnerability": { "name": "CVE-2026-112946" }, "action_statement": "Vulnerability CVE-2026-112946 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.12." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-11-04T02:53:59.455645+00:00", "status_notes": "Vulnerability CVE-2026-112947 does not affect version 4.5.5-tuxcare.2 of vite. not_affected \u2014 The target Vite v4.5.5-tuxcare.10 is not affected by CVE-2026-112947. The vulnerability concerns the `?vite-wasm-instance` query parameter that was introduced as part of the \"WASM ESM Integration\" feature in June 2026 (commit c23d85b96), nearly two years AFTER v4.5.5 was released in September 2024. The target codebase does not contain any code that handles `vite-wasm-instance` query parameters....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112947" }, "impact_statement": "not_affected \u2014 The target Vite v4.5.5-tuxcare.10 is not affected by CVE-2026-112947. The vulnerability concerns the `?vite-wasm-instance` query parameter that was introduced as part of the \"WASM ESM Integration\" feature in June 2026 (commit c23d85b96), nearly two years AFTER v4.5.5 was released in September 2024. The target codebase does not contain any code that handles `vite-wasm-instance` query parameters...." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-10-29T16:43:07.038556+00:00", "status_notes": "Vulnerability CVE-2026-118662 affects version 4.5.5-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-118662" }, "action_statement": "Vulnerability CVE-2026-118662 affects version 4.5.5-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39363 does not affect version 4.5.5-tuxcare.2 of vite. Version 4.5.5 is not vulnerable. Summary: CVE-2026-39363 does not affect Vite 4.5.5. The vulnerability requires fetchModule method and vite:invoke WebSocket event, which were introduced in later versions (5.x/6.x). [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39363" }, "impact_statement": "Version 4.5.5 is not vulnerable. Summary: CVE-2026-39363 does not affect Vite 4.5.5. The vulnerability requires fetchModule method and vite:invoke WebSocket event, which were introduced in later versions (5.x/6.x). [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39364 does not affect version 4.5.5-tuxcare.2 of vite. vite 4.5.5 is outside the affected version range for CVE-2026-39364 per the GitHub Security Advisory and NIST/NVD.", "vulnerability": { "name": "CVE-2026-39364" }, "impact_statement": "vite 4.5.5 is outside the affected version range for CVE-2026-39364 per the GitHub Security Advisory and NIST/NVD." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39365 does not affect version 4.5.5-tuxcare.2 of vite. Version 4.5.5 is not vulnerable. Summary: CVE-2026-39365 path traversal vulnerability was present in the original Vite v4.5.5 but has been patched in version 4.5.5-tuxcare.7. The fix (commit 91f0a4f50, backported on 2026-04-20) adds validation to ensure .map file requests for optimized dependencies cannot traverse outside the optimized deps directory via '../' segments in the URL. The target repository currently includes this security patch. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39365" }, "impact_statement": "Version 4.5.5 is not vulnerable. Summary: CVE-2026-39365 path traversal vulnerability was present in the original Vite v4.5.5 but has been patched in version 4.5.5-tuxcare.7. The fix (commit 91f0a4f50, backported on 2026-04-20) adds validation to ensure .map file requests for optimized dependencies cannot traverse outside the optimized deps directory via '../' segments in the URL. The target repository currently includes this security patch. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53571 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.9.", "vulnerability": { "name": "CVE-2026-53571" }, "action_statement": "Vulnerability CVE-2026-53571 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.9." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53632 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.8.", "vulnerability": { "name": "CVE-2026-53632" }, "action_statement": "Vulnerability CVE-2026-53632 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4w7w-66w2-5vf9 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.7.", "vulnerability": { "name": "GHSA-4w7w-66w2-5vf9" }, "action_statement": "Vulnerability GHSA-4w7w-66w2-5vf9 affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.5-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.5-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v2wj-q39q-566r affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.7.", "vulnerability": { "name": "GHSA-v2wj-q39q-566r" }, "action_statement": "Vulnerability GHSA-v2wj-q39q-566r affects version 4.5.5-tuxcare.2 of vite, and is fixed in 4.5.5-tuxcare.7." } ] }