{
  "@id": "urn:uuid:b92bbcfc-bad3-4626-8a8d-8ade1429680d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T02:45:36.676709+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T04:52:00.041416+00:00",
      "status_notes": "Vulnerability CVE-2022-35204 affects version 5.4.14-tuxcare.2 of vite.",
      "vulnerability": {
        "name": "CVE-2022-35204"
      },
      "action_statement": "Vulnerability CVE-2022-35204 affects version 5.4.14-tuxcare.2 of vite."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T04:52:00.041416+00:00",
      "status_notes": "Vulnerability CVE-2023-34092 affects version 5.4.14-tuxcare.2 of vite.",
      "vulnerability": {
        "name": "CVE-2023-34092"
      },
      "action_statement": "Vulnerability CVE-2023-34092 affects version 5.4.14-tuxcare.2 of vite."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-14T02:45:36.676709+00:00",
      "status_notes": "Vulnerability CVE-2023-49293 does not affect version 5.4.14-tuxcare.2 of vite. not_affected \u2014 Vite 5.4.14 already contains the upstream fix for CVE-2023-49293. The pre-fix `htmlPath = decodeURI(htmlPath)` in devHtmlHook is gone, so the encoded request path stays encoded when the html-proxy URL is built, and a query such as `%22%3E%3C/script%3E...` cannot break out of the src attribute. The fix commits 5b8504048 and f8868afb5 were authored by non-TuxCare authors and are in the upstream r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-49293"
      },
      "impact_statement": "not_affected \u2014 Vite 5.4.14 already contains the upstream fix for CVE-2023-49293. The pre-fix `htmlPath = decodeURI(htmlPath)` in devHtmlHook is gone, so the encoded request path stays encoded when the html-proxy URL is built, and a query such as `%22%3E%3C/script%3E...` cannot break out of the src attribute. The fix commits 5b8504048 and f8868afb5 were authored by non-TuxCare authors and are in the upstream r..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T14:25:00.217895+00:00",
      "status_notes": "Vulnerability CVE-2024-23331 affects version 5.4.14-tuxcare.2 of vite.",
      "vulnerability": {
        "name": "CVE-2024-23331"
      },
      "action_statement": "Vulnerability CVE-2024-23331 affects version 5.4.14-tuxcare.2 of vite."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T23:47:44.058977+00:00",
      "status_notes": "Vulnerability CVE-2024-31207 does not affect version 5.4.14-tuxcare.2 of vite. not_affected \u2014 CVE-2024-31207 is not present in target version 5.4.14-tuxcare.5. The vulnerability (picomatch with matchBase: true failing to match directory patterns in server.fs.deny) was fixed in upstream Vite v5.2.6. The target is based on upstream v5.4.14, which already contained the fix when TuxCare onboarded it. The fix (matchBase: false, dot: true, pattern preprocessing) is present at packages/vite/sr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-31207"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-31207 is not present in target version 5.4.14-tuxcare.5. The vulnerability (picomatch with matchBase: true failing to match directory patterns in server.fs.deny) was fixed in upstream Vite v5.2.6. The target is based on upstream v5.4.14, which already contained the fix when TuxCare onboarded it. The fix (matchBase: false, dot: true, pattern preprocessing) is present at packages/vite/sr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T23:52:00.070015+00:00",
      "status_notes": "Vulnerability CVE-2024-45811 does not affect version 5.4.14-tuxcare.2 of vite. not_affected \u2014 CVE-2024-45811 is not present in vite 5.4.14-tuxcare.5. The vulnerability allowed bypassing file access restrictions by adding `?import&raw` query parameters to `@fs/` URLs. The upstream vendor's fix (commit 6820bb3b9) was already included in the 5.4.14 release when TuxCare onboarded it. The fix validates file access for URLs containing `?raw` or `?url` query parameters in the transform middlew...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-45811"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-45811 is not present in vite 5.4.14-tuxcare.5. The vulnerability allowed bypassing file access restrictions by adding `?import&raw` query parameters to `@fs/` URLs. The upstream vendor's fix (commit 6820bb3b9) was already included in the 5.4.14 release when TuxCare onboarded it. The fix validates file access for URLs containing `?raw` or `?url` query parameters in the transform middlew..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-13T22:33:28.956796+00:00",
      "status_notes": "Vulnerability CVE-2024-45812 does not affect version 5.4.14-tuxcare.2 of vite. not_affected \u2014 The target (vite 5.4.14) already contains the upstream DOM-clobbering fix for CVE-2024-45812 in getRelativeUrlFromDocument (packages/vite/src/node/build.ts:1132-1137). The fix is upstream commit 179b17773 (#18115), authored by thisiszhengyu@gmail.com. It was in the upstream release before the first TuxCare commit, so this is an upstream fix and not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-45812"
      },
      "impact_statement": "not_affected \u2014 The target (vite 5.4.14) already contains the upstream DOM-clobbering fix for CVE-2024-45812 in getRelativeUrlFromDocument (packages/vite/src/node/build.ts:1132-1137). The fix is upstream commit 179b17773 (#18115), authored by thisiszhengyu@gmail.com. It was in the upstream release before the first TuxCare commit, so this is an upstream fix and not a TuxCare backport."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T04:52:00.041416+00:00",
      "status_notes": "Vulnerability CVE-2024-52011 affects version 5.4.14-tuxcare.2 of vite.",
      "vulnerability": {
        "name": "CVE-2024-52011"
      },
      "action_statement": "Vulnerability CVE-2024-52011 affects version 5.4.14-tuxcare.2 of vite."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24010 does not affect version 5.4.14-tuxcare.2 of vite. Version 5.4.14 is not vulnerable. Summary: CVE-2025-24010 path traversal vulnerability in Vite's optimize deps sourcemap handler has been FIXED in this target. The vulnerable code pattern existed (sourcemap file reading without path validation), but the security fix validating paths with isOptimizedDepFile() is present. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-24010"
      },
      "impact_statement": "Version 5.4.14 is not vulnerable. Summary: CVE-2025-24010 path traversal vulnerability in Vite's optimize deps sourcemap handler has been FIXED in this target. The vulnerable code pattern existed (sourcemap file reading without path validation), but the security fix validating paths with isOptimizedDepFile() is present. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-30208 is fixed in version 5.4.14-tuxcare.2 of vite.",
      "vulnerability": {
        "name": "CVE-2025-30208"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31125 is fixed in version 5.4.14-tuxcare.2 of vite.",
      "vulnerability": {
        "name": "CVE-2025-31125"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-31486 is fixed in version 5.4.14-tuxcare.2 of vite.",
      "vulnerability": {
        "name": "CVE-2025-31486"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-32395 is fixed in version 5.4.14-tuxcare.2 of vite.",
      "vulnerability": {
        "name": "CVE-2025-32395"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-46565 is fixed in version 5.4.14-tuxcare.2 of vite.",
      "vulnerability": {
        "name": "CVE-2025-46565"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-58751 is fixed in version 5.4.14-tuxcare.2 of vite.",
      "vulnerability": {
        "name": "CVE-2025-58751"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-58752 is fixed in version 5.4.14-tuxcare.2 of vite.",
      "vulnerability": {
        "name": "CVE-2025-58752"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-62522 is fixed in version 5.4.14-tuxcare.2 of vite.",
      "vulnerability": {
        "name": "CVE-2025-62522"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-13T16:49:00.031274+00:00",
      "status_notes": "Vulnerability CVE-2026-112942 affects version 5.4.14-tuxcare.2 of vite, and is fixed in 5.4.14-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-112942"
      },
      "action_statement": "Vulnerability CVE-2026-112942 affects version 5.4.14-tuxcare.2 of vite, and is fixed in 5.4.14-tuxcare.6."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T18:52:07.310249+00:00",
      "status_notes": "Vulnerability CVE-2026-112943 does not affect version 5.4.14-tuxcare.2 of vite. not_affected \u2014 CVE-2026-112943 describes a command injection vulnerability in the `launch-editor` package (version 2.9.1) where `%` characters are not properly escaped when passing filenames to cmd.exe on Windows, allowing environment variable expansion and arbitrary command execution. Vite version 5.4.14 uses `launch-editor` 2.9.1 as a transitive dependency through `launch-editor-middleware` ^2.9.1. However,...",
      "vulnerability": {
        "name": "CVE-2026-112943"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-112943 describes a command injection vulnerability in the `launch-editor` package (version 2.9.1) where `%` characters are not properly escaped when passing filenames to cmd.exe on Windows, allowing environment variable expansion and arbitrary command execution. Vite version 5.4.14 uses `launch-editor` 2.9.1 as a transitive dependency through `launch-editor-middleware` ^2.9.1. However,..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-13T16:49:00.031274+00:00",
      "status_notes": "Vulnerability CVE-2026-112944 affects version 5.4.14-tuxcare.2 of vite, and is fixed in 5.4.14-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-112944"
      },
      "action_statement": "Vulnerability CVE-2026-112944 affects version 5.4.14-tuxcare.2 of vite, and is fixed in 5.4.14-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-13T16:49:00.031274+00:00",
      "status_notes": "Vulnerability CVE-2026-112945 affects version 5.4.14-tuxcare.2 of vite, and is fixed in 5.4.14-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-112945"
      },
      "action_statement": "Vulnerability CVE-2026-112945 affects version 5.4.14-tuxcare.2 of vite, and is fixed in 5.4.14-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-13T16:49:00.031274+00:00",
      "status_notes": "Vulnerability CVE-2026-112946 affects version 5.4.14-tuxcare.2 of vite, and is fixed in 5.4.14-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-112946"
      },
      "action_statement": "Vulnerability CVE-2026-112946 affects version 5.4.14-tuxcare.2 of vite, and is fixed in 5.4.14-tuxcare.6."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T02:54:41.160467+00:00",
      "status_notes": "Vulnerability CVE-2026-112947 does not affect version 5.4.14-tuxcare.2 of vite. not_affected \u2014 Vite 5.4.14 does not contain the vulnerable code path. The WASM ESM Integration feature that introduced `?vite-wasm-instance` query parameter handling was added in commit c23d85b96 (June 11, 2026) for v8.1.0-beta.0, which is 17 months after v5.4.14's release (January 21, 2025). The target version's wasm plugin only handles `.wasm?init` patterns and does not process `?vite-wasm-instance` request...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-112947"
      },
      "impact_statement": "not_affected \u2014 Vite 5.4.14 does not contain the vulnerable code path. The WASM ESM Integration feature that introduced `?vite-wasm-instance` query parameter handling was added in commit c23d85b96 (June 11, 2026) for v8.1.0-beta.0, which is 17 months after v5.4.14's release (January 21, 2025). The target version's wasm plugin only handles `.wasm?init` patterns and does not process `?vite-wasm-instance` request..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T16:45:45.459074+00:00",
      "status_notes": "Vulnerability CVE-2026-118662 affects version 5.4.14-tuxcare.2 of vite.",
      "vulnerability": {
        "name": "CVE-2026-118662"
      },
      "action_statement": "Vulnerability CVE-2026-118662 affects version 5.4.14-tuxcare.2 of vite."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-39363 does not affect version 5.4.14-tuxcare.2 of vite. Version 5.4.14 is not vulnerable. Summary: The target repository (Vite 5.4.14) does not contain the vulnerability described in CVE-2026-39363. The vulnerable code pattern (fetchModule exposed via WebSocket vite:invoke event) is not present in this version. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-39363"
      },
      "impact_statement": "Version 5.4.14 is not vulnerable. Summary: The target repository (Vite 5.4.14) does not contain the vulnerability described in CVE-2026-39363. The vulnerable code pattern (fetchModule exposed via WebSocket vite:invoke event) is not present in this version. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-39364 does not affect version 5.4.14-tuxcare.2 of vite. Target version 5.4.14-tuxcare.3 is NOT AFFECTED by CVE-2026-39364. While the CVE affects versions 7.1.0 to < 7.3.2 and 8.0.0 to < 8.0.5, the target uses a different architectural implementation that already strips query parameters before checking server.fs.deny patterns. The transform middleware path uses checkServingAccess \u2192 isFileServingAllowed \u2192 fsPathFromUrl \u2192 cleanUrl, which removes query strings like ?raw, ?import&raw, ?url before the deny glob is evaluated, preventing the bypass described in the CVE.",
      "vulnerability": {
        "name": "CVE-2026-39364"
      },
      "impact_statement": "Target version 5.4.14-tuxcare.3 is NOT AFFECTED by CVE-2026-39364. While the CVE affects versions 7.1.0 to < 7.3.2 and 8.0.0 to < 8.0.5, the target uses a different architectural implementation that already strips query parameters before checking server.fs.deny patterns. The transform middleware path uses checkServingAccess \u2192 isFileServingAllowed \u2192 fsPathFromUrl \u2192 cleanUrl, which removes query strings like ?raw, ?import&raw, ?url before the deny glob is evaluated, preventing the bypass described in the CVE."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-39365 affects version 5.4.14-tuxcare.2 of vite, and is fixed in 5.4.14-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-39365"
      },
      "action_statement": "Vulnerability CVE-2026-39365 affects version 5.4.14-tuxcare.2 of vite, and is fixed in 5.4.14-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-53571 affects version 5.4.14-tuxcare.2 of vite, and is fixed in 5.4.14-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-53571"
      },
      "action_statement": "Vulnerability CVE-2026-53571 affects version 5.4.14-tuxcare.2 of vite, and is fixed in 5.4.14-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-53632 does not affect version 5.4.14-tuxcare.2 of vite. already_fixed \u2014 The target repository Vite 5.4.14-tuxcare.3 already contains the exact fix from the vendor patches. The defense code that rejects Windows special path syntax (8.3 short names with '~' and NTFS alternate data streams with ':') was backported by TuxCare on 2026-07-09 as commit 43dd423f9, labeled as CVE-2026-53571 backport. The same code changes address CVE-2026-53632.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-53632"
      },
      "impact_statement": "already_fixed \u2014 The target repository Vite 5.4.14-tuxcare.3 already contains the exact fix from the vendor patches. The defense code that rejects Windows special path syntax (8.3 short names with '~' and NTFS alternate data streams with ':') was backported by TuxCare on 2026-07-09 as commit 43dd423f9, labeled as CVE-2026-53571 backport. The same code changes address CVE-2026-53632."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-4w7w-66w2-5vf9 is fixed in version 5.4.14-tuxcare.2 of vite.",
      "vulnerability": {
        "name": "GHSA-4w7w-66w2-5vf9"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/vite@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T16:20:54.459511+00:00",
      "status_notes": "Vulnerability GHSA-v2wj-q39q-566r does not affect version 5.4.14-tuxcare.2 of vite. not_affected \u2014 Target vite 5.4.14-tuxcare.4 is not vulnerable to GHSA-v2wj-q39q-566r. The vulnerable code pattern from upstream vite 8.x (using checkLoadingAccess on uncleaned URLs) is not present. Instead, the target uses deniedServingAccessForTransform with checkServingAccess, which internally calls fsPathFromUrl \u2192 cleanUrl to strip query parameters before checking server.fs.deny patterns. This provides equ...",
      "vulnerability": {
        "name": "GHSA-v2wj-q39q-566r"
      },
      "impact_statement": "not_affected \u2014 Target vite 5.4.14-tuxcare.4 is not vulnerable to GHSA-v2wj-q39q-566r. The vulnerable code pattern from upstream vite 8.x (using checkLoadingAccess on uncleaned URLs) is not present. Instead, the target uses deniedServingAccessForTransform with checkServingAccess, which internally calls fsPathFromUrl \u2192 cleanUrl to strip query parameters before checking server.fs.deny patterns. This provides equ..."
    }
  ]
}