{ "@id": "urn:uuid:ae7251db-3a57-4783-bb98-5e72f39e1c4e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 15, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T11:39:41.446655+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 5.4.19 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 5.4.19 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 5.4.19 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 5.4.19 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-49293 affects version 5.4.19 of vite.", "vulnerability": { "name": "CVE-2023-49293" }, "action_statement": "Vulnerability CVE-2023-49293 affects version 5.4.19 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-23331 affects version 5.4.19 of vite.", "vulnerability": { "name": "CVE-2024-23331" }, "action_statement": "Vulnerability CVE-2024-23331 affects version 5.4.19 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-11-03T23:48:00.072451+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 5.4.19 of vite. not_affected \u2014 The target Vite v5.4.19 is not affected by CVE-2024-31207. The vulnerability (fs.deny bypass with directory patterns due to picomatch misconfiguration) was fixed in upstream commit ba5269cca8 by Vite developer green@sapphi.red on 2024-03-24. This fix shipped in upstream v5.2.6 and all subsequent releases. The target's v5.4.19 release inherits this fix from upstream - the vulnerable pattern (mat...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "not_affected \u2014 The target Vite v5.4.19 is not affected by CVE-2024-31207. The vulnerability (fs.deny bypass with directory patterns due to picomatch misconfiguration) was fixed in upstream commit ba5269cca8 by Vite developer green@sapphi.red on 2024-03-24. This fix shipped in upstream v5.2.6 and all subsequent releases. The target's v5.4.19 release inherits this fix from upstream - the vulnerable pattern (mat..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-11-03T23:52:40.196812+00:00", "status_notes": "Vulnerability CVE-2024-45811 does not affect version 5.4.19 of vite. not_affected \u2014 CVE-2024-45811 is NOT present in Vite 5.4.19. The vulnerability allowed bypassing `@fs` access controls using `?import&raw` query parameters to read arbitrary files outside the serving allow list. The fix was implemented in upstream commit 6820bb3b9 by Vite maintainer \"patak\" and shipped in Vite v5.4.6. The target version (5.4.19) is 13 releases after v5.4.6, so the fix has been present since l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45811" }, "impact_statement": "not_affected \u2014 CVE-2024-45811 is NOT present in Vite 5.4.19. The vulnerability allowed bypassing `@fs` access controls using `?import&raw` query parameters to read arbitrary files outside the serving allow list. The fix was implemented in upstream commit 6820bb3b9 by Vite maintainer \"patak\" and shipped in Vite v5.4.6. The target version (5.4.19) is 13 releases after v5.4.6, so the fix has been present since l..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-45812 affects version 5.4.19 of vite.", "vulnerability": { "name": "CVE-2024-45812" }, "action_statement": "Vulnerability CVE-2024-45812 affects version 5.4.19 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-52011 affects version 5.4.19 of vite.", "vulnerability": { "name": "CVE-2024-52011" }, "action_statement": "Vulnerability CVE-2024-52011 affects version 5.4.19 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-11-03T23:57:49.636936+00:00", "status_notes": "Vulnerability CVE-2025-24010 does not affect version 5.4.19 of vite. not_affected \u2014 Vite 5.4.19 is NOT AFFECTED by CVE-2025-24010. All three security vulnerabilities (permissive CORS, WebSocket hijacking, DNS rebinding) were fixed upstream in Vite v5.4.12 (January 2025) by sapphi-red, before v5.4.19 was released (April 2025). The target repository contains the complete upstream release with all defenses present: WebSocket token validation (ws.ts:94-109), Host header validation...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24010" }, "impact_statement": "not_affected \u2014 Vite 5.4.19 is NOT AFFECTED by CVE-2025-24010. All three security vulnerabilities (permissive CORS, WebSocket hijacking, DNS rebinding) were fixed upstream in Vite v5.4.12 (January 2025) by sapphi-red, before v5.4.19 was released (April 2025). The target repository contains the complete upstream release with all defenses present: WebSocket token validation (ws.ts:94-109), Host header validation..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-11-06T11:25:00.048413+00:00", "status_notes": "Vulnerability CVE-2025-30208 does not affect version 5.4.19 of vite. not_affected \u2014 Vite 5.4.19 already contains the upstream fix for CVE-2025-30208. The fix is commit 807d7f06d, \"fix: backport #19702, fs raw query with query separators\", authored by green@sapphi.red. It shipped in the upstream v5.4.15 release, well before this target. The transform middleware now strips trailing `?`/`&` separators before the serving-access check, so `?import&raw??` can no longer bypass the `@...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-30208" }, "impact_statement": "not_affected \u2014 Vite 5.4.19 already contains the upstream fix for CVE-2025-30208. The fix is commit 807d7f06d, \"fix: backport #19702, fs raw query with query separators\", authored by green@sapphi.red. It shipped in the upstream v5.4.15 release, well before this target. The transform middleware now strips trailing `?`/`&` separators before the serving-access check, so `?import&raw??` can no longer bypass the `@..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-11-06T11:29:00.045585+00:00", "status_notes": "Vulnerability CVE-2025-31125 does not affect version 5.4.19 of vite. not_affected \u2014 Vite 5.4.19 already contains the upstream fixes for CVE-2025-31125: backport #19702 (807d7f06d) and backport #19761 (b627c50d3). The transform middleware now runs the serving-access check on URLs carrying raw, url, inline or svg markers. It also re-checks every module id inside transformRequest through allowId. Both fixes shipped in the upstream v5.4.15 and v5.4.16 releases, before any TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31125" }, "impact_statement": "not_affected \u2014 Vite 5.4.19 already contains the upstream fixes for CVE-2025-31125: backport #19702 (807d7f06d) and backport #19761 (b627c50d3). The transform middleware now runs the serving-access check on URLs carrying raw, url, inline or svg markers. It also re-checks every module id inside transformRequest through allowId. Both fixes shipped in the upstream v5.4.15 and v5.4.16 releases, before any TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-11-06T11:32:00.041448+00:00", "status_notes": "Vulnerability CVE-2025-31486 does not affect version 5.4.19 of vite. not_affected \u2014 Vite 5.4.19 already contains the upstream fix for CVE-2025-31486. Commit 84b2b46ed (upstream backport of #19782, \"fs check with svg and relative paths\") is an ancestor of HEAD. It was authored by the upstream maintainer patak and shipped in the upstream 5.4.17 release. HEAD's history has no TuxCare-domain commit, so this is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31486" }, "impact_statement": "not_affected \u2014 Vite 5.4.19 already contains the upstream fix for CVE-2025-31486. Commit 84b2b46ed (upstream backport of #19782, \"fs check with svg and relative paths\") is an ancestor of HEAD. It was authored by the upstream maintainer patak and shipped in the upstream 5.4.17 release. HEAD's history has no TuxCare-domain commit, so this is an upstream fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-11-06T11:39:41.446655+00:00", "status_notes": "Vulnerability CVE-2025-32395 does not affect version 5.4.19 of vite. not_affected \u2014 Vite 5.4.19 already contains the upstream fix for CVE-2025-32395. Commit 823675baf (\"fix: backport #19830, reject requests with `#` in request-target\") was authored upstream by green@sapphi.red and shipped in v5.4.18. The dev server rejects any request whose req.url contains '#' with a 400 before any fs.deny or file-serving middleware runs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32395" }, "impact_statement": "not_affected \u2014 Vite 5.4.19 already contains the upstream fix for CVE-2025-32395. Commit 823675baf (\"fix: backport #19830, reject requests with `#` in request-target\") was authored upstream by green@sapphi.red and shipped in v5.4.18. The dev server rejects any request whose req.url contains '#' with a 400 before any fs.deny or file-serving middleware runs." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-11-04T00:05:00.146736+00:00", "status_notes": "Vulnerability CVE-2025-46565 does not affect version 5.4.19 of vite. not_affected \u2014 CVE-2025-46565 fix was shipped in upstream Vite v5.4.19 release (commit 766947e7c by green@sapphi.red). The target is Vite 5.4.19, which already contains the complete fix. The vulnerability allowed bypassing server.fs.deny patterns using path manipulation (e.g., `/.env/.`), but the fix adds a shouldServe callback that validates resolved file paths against deny patterns before serving through si...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46565" }, "impact_statement": "not_affected \u2014 CVE-2025-46565 fix was shipped in upstream Vite v5.4.19 release (commit 766947e7c by green@sapphi.red). The target is Vite 5.4.19, which already contains the complete fix. The vulnerability allowed bypassing server.fs.deny patterns using path manipulation (e.g., `/.env/.`), but the fix adds a shouldServe callback that validates resolved file paths against deny patterns before serving through si..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-10-23T14:43:45.796800+00:00", "status_notes": "Vulnerability CVE-2025-58751 affects version 5.4.19 of vite.", "vulnerability": { "name": "CVE-2025-58751" }, "action_statement": "Vulnerability CVE-2025-58751 affects version 5.4.19 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-10-23T14:43:45.796800+00:00", "status_notes": "Vulnerability CVE-2025-58752 affects version 5.4.19 of vite.", "vulnerability": { "name": "CVE-2025-58752" }, "action_statement": "Vulnerability CVE-2025-58752 affects version 5.4.19 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-10-23T14:43:45.796800+00:00", "status_notes": "Vulnerability CVE-2025-62522 affects version 5.4.19 of vite.", "vulnerability": { "name": "CVE-2025-62522" }, "action_statement": "Vulnerability CVE-2025-62522 affects version 5.4.19 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-10-23T14:43:45.796800+00:00", "status_notes": "Vulnerability CVE-2026-112942 does not affect version 5.4.19 of vite. not_affected \u2014 Vite v5.4.19 does not contain the vulnerable code described in CVE-2026-112942. The vulnerability exists in the external dependency `launch-editor-middleware@^2.9.1`, which Vite imports and uses for its `/__open-in-editor` endpoint. Vite's source repository contains only an import statement and middleware registration - the vulnerable path-handling logic (fs.existsSync bypass with \\\\...:line:co...", "vulnerability": { "name": "CVE-2026-112942" }, "impact_statement": "not_affected \u2014 Vite v5.4.19 does not contain the vulnerable code described in CVE-2026-112942. The vulnerability exists in the external dependency `launch-editor-middleware@^2.9.1`, which Vite imports and uses for its `/__open-in-editor` endpoint. Vite's source repository contains only an import statement and middleware registration - the vulnerable path-handling logic (fs.existsSync bypass with \\\\...:line:co..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-10-23T14:43:45.796800+00:00", "status_notes": "Vulnerability CVE-2026-112943 does not affect version 5.4.19 of vite. not_affected \u2014 The vulnerability CVE-2026-112943 affects the `launch-editor` npm package (improper escaping of `%` characters when passing file paths to cmd.exe on Windows). Vite uses `launch-editor` as a transitive dependency via `launch-editor-middleware@2.9.1`, but does NOT vendor or bundle the `launch-editor` source code in its repository. The vulnerable code pattern is NOT present in Vite's codebase - it...", "vulnerability": { "name": "CVE-2026-112943" }, "impact_statement": "not_affected \u2014 The vulnerability CVE-2026-112943 affects the `launch-editor` npm package (improper escaping of `%` characters when passing file paths to cmd.exe on Windows). Vite uses `launch-editor` as a transitive dependency via `launch-editor-middleware@2.9.1`, but does NOT vendor or bundle the `launch-editor` source code in its repository. The vulnerable code pattern is NOT present in Vite's codebase - it..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-10-23T14:43:45.796800+00:00", "status_notes": "Vulnerability CVE-2026-112944 affects version 5.4.19 of vite.", "vulnerability": { "name": "CVE-2026-112944" }, "action_statement": "Vulnerability CVE-2026-112944 affects version 5.4.19 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-10-23T14:43:45.796800+00:00", "status_notes": "Vulnerability CVE-2026-112945 affects version 5.4.19 of vite.", "vulnerability": { "name": "CVE-2026-112945" }, "action_statement": "Vulnerability CVE-2026-112945 affects version 5.4.19 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-10-23T14:43:45.796800+00:00", "status_notes": "Vulnerability CVE-2026-112946 affects version 5.4.19 of vite.", "vulnerability": { "name": "CVE-2026-112946" }, "action_statement": "Vulnerability CVE-2026-112946 affects version 5.4.19 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-11-04T02:56:20.215700+00:00", "status_notes": "Vulnerability CVE-2026-112947 does not affect version 5.4.19 of vite. not_affected \u2014 The target repository (Vite 5.4.19, HEAD at efc927b8b, Oct 2 2026) does not contain the vulnerable feature. CVE-2026-112947 exploits the `?vite-wasm-instance` query parameter introduced by the WASM ESM Integration feature (commit c23d85b96, June 11 2026) and expanded in commit 9e79b5157 (July 16 2026). Neither commit is an ancestor of HEAD. The current version only supports `.wasm?init` imports...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112947" }, "impact_statement": "not_affected \u2014 The target repository (Vite 5.4.19, HEAD at efc927b8b, Oct 2 2026) does not contain the vulnerable feature. CVE-2026-112947 exploits the `?vite-wasm-instance` query parameter introduced by the WASM ESM Integration feature (commit c23d85b96, June 11 2026) and expanded in commit 9e79b5157 (July 16 2026). Neither commit is an ancestor of HEAD. The current version only supports `.wasm?init` imports..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-10-29T16:45:45.459074+00:00", "status_notes": "Vulnerability CVE-2026-118662 affects version 5.4.19 of vite.", "vulnerability": { "name": "CVE-2026-118662" }, "action_statement": "Vulnerability CVE-2026-118662 affects version 5.4.19 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-10-30T14:48:00.154664+00:00", "status_notes": "Vulnerability CVE-2026-39363 affects version 5.4.19 of vite.", "vulnerability": { "name": "CVE-2026-39363" }, "action_statement": "Vulnerability CVE-2026-39363 affects version 5.4.19 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-10-30T14:48:00.154664+00:00", "status_notes": "Vulnerability CVE-2026-39364 affects version 5.4.19 of vite.", "vulnerability": { "name": "CVE-2026-39364" }, "action_statement": "Vulnerability CVE-2026-39364 affects version 5.4.19 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-10-23T14:43:45.796800+00:00", "status_notes": "Vulnerability CVE-2026-39365 affects version 5.4.19 of vite.", "vulnerability": { "name": "CVE-2026-39365" }, "action_statement": "Vulnerability CVE-2026-39365 affects version 5.4.19 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-10-23T14:43:45.796800+00:00", "status_notes": "Vulnerability CVE-2026-53571 affects version 5.4.19 of vite.", "vulnerability": { "name": "CVE-2026-53571" }, "action_statement": "Vulnerability CVE-2026-53571 affects version 5.4.19 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.19", "identifiers": { "purl": "pkg:npm/vite@5.4.19" } } ], "timestamp": "2026-10-23T14:43:45.796800+00:00", "status_notes": "Vulnerability CVE-2026-53632 affects version 5.4.19 of vite.", "vulnerability": { "name": "CVE-2026-53632" }, "action_statement": "Vulnerability CVE-2026-53632 affects version 5.4.19 of vite." } ] }