{ "@id": "urn:uuid:98a6b823-bf6b-4a89-9209-7d4bfb9e9bee", "role": "Document Creator", "author": "https://tuxcare.com", "version": 22, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T11:37:00.035304+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 5.4.20 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 5.4.20 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 5.4.20 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 5.4.20 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-49293 affects version 5.4.20 of vite.", "vulnerability": { "name": "CVE-2023-49293" }, "action_statement": "Vulnerability CVE-2023-49293 affects version 5.4.20 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-23331 affects version 5.4.20 of vite.", "vulnerability": { "name": "CVE-2024-23331" }, "action_statement": "Vulnerability CVE-2024-23331 affects version 5.4.20 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-11-03T23:48:15.500065+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 5.4.20 of vite. not_affected \u2014 CVE-2024-31207 affects Vite's `server.fs.deny` glob pattern matching, which failed to properly deny access to files matching directory patterns (e.g., `**/.git/**`) due to picomatch being configured with `matchBase: true` (matching only basenames) and missing `dot: true` (not matching dotfiles). The vulnerability was fixed in upstream commit ba5269cca by setting `matchBase: false`, adding `dot:...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "not_affected \u2014 CVE-2024-31207 affects Vite's `server.fs.deny` glob pattern matching, which failed to properly deny access to files matching directory patterns (e.g., `**/.git/**`) due to picomatch being configured with `matchBase: true` (matching only basenames) and missing `dot: true` (not matching dotfiles). The vulnerability was fixed in upstream commit ba5269cca by setting `matchBase: false`, adding `dot:..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-11-03T23:52:13.422768+00:00", "status_notes": "Vulnerability CVE-2024-45811 does not affect version 5.4.20 of vite. not_affected \u2014 The target Vite 5.4.20 is not affected by CVE-2024-45811. The vulnerability allowing bypass of `@fs` access restrictions via `?import&raw` query parameters was fixed in upstream commit 6820bb3b9 by Vite maintainer patak, which shipped in the v5.4.20 release before TuxCare's onboarding. The fix adds serving access checks in the transform middleware for URLs containing `?raw` or `?url` query para...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45811" }, "impact_statement": "not_affected \u2014 The target Vite 5.4.20 is not affected by CVE-2024-45811. The vulnerability allowing bypass of `@fs` access restrictions via `?import&raw` query parameters was fixed in upstream commit 6820bb3b9 by Vite maintainer patak, which shipped in the v5.4.20 release before TuxCare's onboarding. The fix adds serving access checks in the transform middleware for URLs containing `?raw` or `?url` query para..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-45812 affects version 5.4.20 of vite.", "vulnerability": { "name": "CVE-2024-45812" }, "action_statement": "Vulnerability CVE-2024-45812 affects version 5.4.20 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-52011 affects version 5.4.20 of vite.", "vulnerability": { "name": "CVE-2024-52011" }, "action_statement": "Vulnerability CVE-2024-52011 affects version 5.4.20 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-11-04T00:01:16.639479+00:00", "status_notes": "Vulnerability CVE-2025-24010 does not affect version 5.4.20 of vite. not_affected \u2014 The target repository (Vite 5.4.20) is NOT AFFECTED by CVE-2025-24010. All three vulnerabilities described in the CVE (permissive CORS, WebSocket hijacking, DNS rebinding) were fixed by upstream Vite maintainers in January 2025 and included in the v5.4.20 release. The fixes were authored by sapphi-red (upstream vendor, not TuxCare) and shipped in the upstream release before any TuxCare modifica...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24010" }, "impact_statement": "not_affected \u2014 The target repository (Vite 5.4.20) is NOT AFFECTED by CVE-2025-24010. All three vulnerabilities described in the CVE (permissive CORS, WebSocket hijacking, DNS rebinding) were fixed by upstream Vite maintainers in January 2025 and included in the v5.4.20 release. The fixes were authored by sapphi-red (upstream vendor, not TuxCare) and shipped in the upstream release before any TuxCare modifica..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-11-06T11:25:05.362051+00:00", "status_notes": "Vulnerability CVE-2025-30208 does not affect version 5.4.20 of vite. not_affected \u2014 Vite 5.4.20 already contains the upstream fix for CVE-2025-30208. The transform middleware strips trailing '?'/'&' separators before the fs-access check, so `?import&raw??` can no longer bypass the @fs deny list. The fix was shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-30208" }, "impact_statement": "not_affected \u2014 Vite 5.4.20 already contains the upstream fix for CVE-2025-30208. The transform middleware strips trailing '?'/'&' separators before the fs-access check, so `?import&raw??` can no longer bypass the @fs deny list. The fix was shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-11-06T11:30:06.317055+00:00", "status_notes": "Vulnerability CVE-2025-31125 does not affect version 5.4.20 of vite. not_affected \u2014 Vite 5.4.20 already contains the upstream fixes for CVE-2025-31125. They were shipped as upstream backports: b627c50d3 (#19762, backport of #19761, fs check in the transform middleware) and 807d7f06d (#19703, backport of #19702, handling of query separators). The transform middleware denies non-allowed files for `?raw`, `?url`, `?inline` and `.svg` requests, including `?raw?import` and `?inline...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31125" }, "impact_statement": "not_affected \u2014 Vite 5.4.20 already contains the upstream fixes for CVE-2025-31125. They were shipped as upstream backports: b627c50d3 (#19762, backport of #19761, fs check in the transform middleware) and 807d7f06d (#19703, backport of #19702, handling of query separators). The transform middleware denies non-allowed files for `?raw`, `?url`, `?inline` and `.svg` requests, including `?raw?import` and `?inline..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-11-06T11:30:06.317055+00:00", "status_notes": "Vulnerability CVE-2025-31486 does not affect version 5.4.20 of vite. not_affected \u2014 Vite 5.4.20 already contains the upstream fix for CVE-2025-31486 (commit 84b2b46ed, \"backport #19782, fs check with svg and relative paths\", released in 5.4.16). The fix was in the upstream release before the first TuxCare commit, so it is an upstream fix and the vulnerable pattern is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31486" }, "impact_statement": "not_affected \u2014 Vite 5.4.20 already contains the upstream fix for CVE-2025-31486 (commit 84b2b46ed, \"backport #19782, fs check with svg and relative paths\", released in 5.4.16). The fix was in the upstream release before the first TuxCare commit, so it is an upstream fix and the vulnerable pattern is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-11-06T11:37:00.035304+00:00", "status_notes": "Vulnerability CVE-2025-32395 does not affect version 5.4.20 of vite. not_affected \u2014 Vite 5.4.20 already contains the upstream fix for CVE-2025-32395. rejectInvalidRequestMiddleware returns 400 for any req.url containing '#' and is registered early in the dev-server middleware chain. This upstream backport (#19831) shipped in the release, and HEAD has no TuxCare commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32395" }, "impact_statement": "not_affected \u2014 Vite 5.4.20 already contains the upstream fix for CVE-2025-32395. rejectInvalidRequestMiddleware returns 400 for any req.url containing '#' and is registered early in the dev-server middleware chain. This upstream backport (#19831) shipped in the release, and HEAD has no TuxCare commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-11-04T00:03:00.060653+00:00", "status_notes": "Vulnerability CVE-2025-46565 does not affect version 5.4.20 of vite. not_affected \u2014 Target vite 5.4.20 is NOT AFFECTED by CVE-2025-46565. The vulnerability (bypassing server.fs.deny patterns using /. path manipulation to access restricted files like .env) has been fixed by upstream commit 766947e7c, which shipped in v5.4.19 (released 2025-04-30). The fix moves access validation INSIDE sirv's file serving logic via a shouldServe callback, so checks operate on the normalized fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46565" }, "impact_statement": "not_affected \u2014 Target vite 5.4.20 is NOT AFFECTED by CVE-2025-46565. The vulnerability (bypassing server.fs.deny patterns using /. path manipulation to access restricted files like .env) has been fixed by upstream commit 766947e7c, which shipped in v5.4.19 (released 2025-04-30). The fix moves access validation INSIDE sirv's file serving logic via a shouldServe callback, so checks operate on the normalized fi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-11-04T00:09:00.102886+00:00", "status_notes": "Vulnerability CVE-2025-58751 does not affect version 5.4.20 of vite. not_affected \u2014 Target version 5.4.20 is not affected by CVE-2025-58751. The vulnerability (path traversal via insufficient directory boundary validation in sirv when symlinks exist in the public directory) was fixed in upstream commit 4f1c35bcbb5830290c694aa14b6789e07450f069 by developer \u7fe0 , which was included in the upstream Vite v5.4.20 release (Sep 8, 2025) before TuxCare onboarded this v...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58751" }, "impact_statement": "not_affected \u2014 Target version 5.4.20 is not affected by CVE-2025-58751. The vulnerability (path traversal via insufficient directory boundary validation in sirv when symlinks exist in the public directory) was fixed in upstream commit 4f1c35bcbb5830290c694aa14b6789e07450f069 by developer \u7fe0 , which was included in the upstream Vite v5.4.20 release (Sep 8, 2025) before TuxCare onboarded this v..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-11-04T00:23:31.088036+00:00", "status_notes": "Vulnerability CVE-2025-58752 does not affect version 5.4.20 of vite. not_affected \u2014 CVE-2025-58752 describes a path traversal vulnerability allowing arbitrary HTML files to be served bypassing server.fs security settings. The fix (commit 482000f57, upstream PR #20736) adds validation via checkLoadingAccess() for dev server and isParentDirectory() for preview server before serving HTML files. This fix was included in upstream Vite v5.4.20 (released September 8, 2025). The targe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58752" }, "impact_statement": "not_affected \u2014 CVE-2025-58752 describes a path traversal vulnerability allowing arbitrary HTML files to be served bypassing server.fs security settings. The fix (commit 482000f57, upstream PR #20736) adds validation via checkLoadingAccess() for dev server and isParentDirectory() for preview server before serving HTML files. This fix was included in upstream Vite v5.4.20 (released September 8, 2025). The targe..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-10-15T12:13:41.094671+00:00", "status_notes": "Vulnerability CVE-2025-62522 affects version 5.4.20 of vite.", "vulnerability": { "name": "CVE-2025-62522" }, "action_statement": "Vulnerability CVE-2025-62522 affects version 5.4.20 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-10-20T20:27:00.112456+00:00", "status_notes": "Vulnerability CVE-2026-112942 does not affect version 5.4.20 of vite. not_affected \u2014 CVE-2026-112942 describes a path validation bypass vulnerability in the `launch-editor` npm package (versions allowing `\\\\..:line:column` paths to bypass `fs.existsSync()` checks on Windows, enabling OS command injection). The Vite repository (v5.4.20) declares `launch-editor-middleware@2.9.1` as a dependency, which transitively depends on `launch-editor@2.9.1`. However, Vite does NOT contain a...", "vulnerability": { "name": "CVE-2026-112942" }, "impact_statement": "not_affected \u2014 CVE-2026-112942 describes a path validation bypass vulnerability in the `launch-editor` npm package (versions allowing `\\\\..:line:column` paths to bypass `fs.existsSync()` checks on Windows, enabling OS command injection). The Vite repository (v5.4.20) declares `launch-editor-middleware@2.9.1` as a dependency, which transitively depends on `launch-editor@2.9.1`. However, Vite does NOT contain a..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-10-20T18:41:00.126701+00:00", "status_notes": "Vulnerability CVE-2026-112943 affects version 5.4.20 of vite.", "vulnerability": { "name": "CVE-2026-112943" }, "action_statement": "Vulnerability CVE-2026-112943 affects version 5.4.20 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-10-20T20:48:00.128312+00:00", "status_notes": "Vulnerability CVE-2026-112944 does not affect version 5.4.20 of vite. not_affected \u2014 Vite 5.4.20 is not affected by CVE-2026-112944. The vulnerable pattern (forwarding file paths directly to editors without sanitization) is not present in the target. Upstream commit 508d9ab83 (October 2024) upgraded launch-editor-middleware from v2.8.1 to v2.9.1, which includes the fix that converts relative file paths to absolute paths before passing them to editors. This defense prevents path...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112944" }, "impact_statement": "not_affected \u2014 Vite 5.4.20 is not affected by CVE-2026-112944. The vulnerable pattern (forwarding file paths directly to editors without sanitization) is not present in the target. Upstream commit 508d9ab83 (October 2024) upgraded launch-editor-middleware from v2.8.1 to v2.9.1, which includes the fix that converts relative file paths to absolute paths before passing them to editors. This defense prevents path..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-10-21T16:56:40.126672+00:00", "status_notes": "Vulnerability CVE-2026-112945 affects version 5.4.20 of vite.", "vulnerability": { "name": "CVE-2026-112945" }, "action_statement": "Vulnerability CVE-2026-112945 affects version 5.4.20 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-10-21T16:56:40.126672+00:00", "status_notes": "Vulnerability CVE-2026-112946 affects version 5.4.20 of vite.", "vulnerability": { "name": "CVE-2026-112946" }, "action_statement": "Vulnerability CVE-2026-112946 affects version 5.4.20 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-10-31T13:23:59.275184+00:00", "status_notes": "Vulnerability CVE-2026-112947 affects version 5.4.20 of vite.", "vulnerability": { "name": "CVE-2026-112947" }, "action_statement": "Vulnerability CVE-2026-112947 affects version 5.4.20 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-10-29T16:45:45.459074+00:00", "status_notes": "Vulnerability CVE-2026-118662 affects version 5.4.20 of vite.", "vulnerability": { "name": "CVE-2026-118662" }, "action_statement": "Vulnerability CVE-2026-118662 affects version 5.4.20 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-10-30T14:48:00.154664+00:00", "status_notes": "Vulnerability CVE-2026-39363 affects version 5.4.20 of vite.", "vulnerability": { "name": "CVE-2026-39363" }, "action_statement": "Vulnerability CVE-2026-39363 affects version 5.4.20 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-10-30T14:48:00.154664+00:00", "status_notes": "Vulnerability CVE-2026-39364 affects version 5.4.20 of vite.", "vulnerability": { "name": "CVE-2026-39364" }, "action_statement": "Vulnerability CVE-2026-39364 affects version 5.4.20 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-10-15T12:13:41.094671+00:00", "status_notes": "Vulnerability CVE-2026-39365 affects version 5.4.20 of vite.", "vulnerability": { "name": "CVE-2026-39365" }, "action_statement": "Vulnerability CVE-2026-39365 affects version 5.4.20 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-10-15T12:13:41.094671+00:00", "status_notes": "Vulnerability CVE-2026-53571 affects version 5.4.20 of vite.", "vulnerability": { "name": "CVE-2026-53571" }, "action_statement": "Vulnerability CVE-2026-53571 affects version 5.4.20 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.20", "identifiers": { "purl": "pkg:npm/vite@5.4.20" } } ], "timestamp": "2026-10-16T17:15:00.756690+00:00", "status_notes": "Vulnerability CVE-2026-53632 affects version 5.4.20 of vite.", "vulnerability": { "name": "CVE-2026-53632" }, "action_statement": "Vulnerability CVE-2026-53632 affects version 5.4.20 of vite." } ] }