{ "@id": "urn:uuid:2c1924ac-5cb2-4b4d-9222-6d002859f522", "role": "Document Creator", "author": "https://tuxcare.com", "version": 19, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T11:32:00.041448+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 5.4.21 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 5.4.21 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 5.4.21 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 5.4.21 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-49293 affects version 5.4.21 of vite.", "vulnerability": { "name": "CVE-2023-49293" }, "action_statement": "Vulnerability CVE-2023-49293 affects version 5.4.21 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-23331 affects version 5.4.21 of vite.", "vulnerability": { "name": "CVE-2024-23331" }, "action_statement": "Vulnerability CVE-2024-23331 affects version 5.4.21 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-11-03T23:46:34.444746+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 5.4.21 of vite. not_affected \u2014 The target (Vite 5.4.21-tuxcare.4) is NOT affected by CVE-2024-31207. The vulnerability involved `server.fs.deny` patterns with directories being incorrectly matched due to picomatch's `matchBase: true` (which only matches basenames) and missing `dot: true` (which excluded dotfiles). The upstream fix (commit ba5269cca81de3f5fbb0f49d58a1c55688043258 by green@sapphi.red) was already present in th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "not_affected \u2014 The target (Vite 5.4.21-tuxcare.4) is NOT affected by CVE-2024-31207. The vulnerability involved `server.fs.deny` patterns with directories being incorrectly matched due to picomatch's `matchBase: true` (which only matches basenames) and missing `dot: true` (which excluded dotfiles). The upstream fix (commit ba5269cca81de3f5fbb0f49d58a1c55688043258 by green@sapphi.red) was already present in th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-11-03T23:50:59.896905+00:00", "status_notes": "Vulnerability CVE-2024-45811 does not affect version 5.4.21 of vite. not_affected \u2014 CVE-2024-45811 is NOT present in this target. The vulnerability allowed bypassing Vite's @fs access control by adding ?import&raw query parameters to requests. The upstream fix (commit 6820bb3b9 from September 2024) was already present in the Vite 5.4.21 release that TuxCare onboarded in August 2026. The defense code in transform.ts checks for raw/url query parameters and validates access befor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45811" }, "impact_statement": "not_affected \u2014 CVE-2024-45811 is NOT present in this target. The vulnerability allowed bypassing Vite's @fs access control by adding ?import&raw query parameters to requests. The upstream fix (commit 6820bb3b9 from September 2024) was already present in the Vite 5.4.21 release that TuxCare onboarded in August 2026. The defense code in transform.ts checks for raw/url query parameters and validates access befor..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-45812 affects version 5.4.21 of vite.", "vulnerability": { "name": "CVE-2024-45812" }, "action_statement": "Vulnerability CVE-2024-45812 affects version 5.4.21 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-52011 affects version 5.4.21 of vite.", "vulnerability": { "name": "CVE-2024-52011" }, "action_statement": "Vulnerability CVE-2024-52011 affects version 5.4.21 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-24010 does not affect version 5.4.21 of vite. already_fixed \u2014 CVE-2025-24010 has been fixed in the target repository. The target (Vite v5.4.21-tuxcare.1) contains all three core defensive mechanisms against the CVE's attack vectors: (1) WebSocket token validation preventing Cross-Site WebSocket Hijacking, (2) Host header validation preventing DNS rebinding attacks, and (3) CORS restrictions limiting cross-origin access. While the CORS implementation diffe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24010" }, "impact_statement": "already_fixed \u2014 CVE-2025-24010 has been fixed in the target repository. The target (Vite v5.4.21-tuxcare.1) contains all three core defensive mechanisms against the CVE's attack vectors: (1) WebSocket token validation preventing Cross-Site WebSocket Hijacking, (2) Host header validation preventing DNS rebinding attacks, and (3) CORS restrictions limiting cross-origin access. While the CORS implementation diffe..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-11-06T11:25:00.048413+00:00", "status_notes": "Vulnerability CVE-2025-30208 does not affect version 5.4.21 of vite. not_affected \u2014 Not affected. The upstream fix for CVE-2025-30208 (vite backport commit 807d7f06, PR #19703) is already in the shipped 5.4.x release. It predates the first TuxCare commit and was authored by green@sapphi.red.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-30208" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2025-30208 (vite backport commit 807d7f06, PR #19703) is already in the shipped 5.4.x release. It predates the first TuxCare commit and was authored by green@sapphi.red." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-11-06T11:28:00.026983+00:00", "status_notes": "Vulnerability CVE-2025-31125 does not affect version 5.4.21 of vite. not_affected \u2014 Vite 5.4.21 is past the 5.4.16 fix for CVE-2025-31125. The dev-server transform middleware calls the fs.allow check on requests carrying ?raw, ?url, ?inline or .svg before any transform or load. The fix shipped in the upstream release TuxCare onboarded, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31125" }, "impact_statement": "not_affected \u2014 Vite 5.4.21 is past the 5.4.16 fix for CVE-2025-31125. The dev-server transform middleware calls the fs.allow check on requests carrying ?raw, ?url, ?inline or .svg before any transform or load. The fix shipped in the upstream release TuxCare onboarded, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-11-06T11:30:06.317055+00:00", "status_notes": "Vulnerability CVE-2025-31486 does not affect version 5.4.21 of vite. not_affected \u2014 Vite 5.4.21 already contains the upstream fix for CVE-2025-31486 (backport commit 84b2b46, \"fs check with svg and relative paths\", upstream fix for 5.x in 5.4.16). It shipped in the upstream release TuxCare onboarded, so the vulnerable pattern is not present in HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31486" }, "impact_statement": "not_affected \u2014 Vite 5.4.21 already contains the upstream fix for CVE-2025-31486 (backport commit 84b2b46, \"fs check with svg and relative paths\", upstream fix for 5.x in 5.4.16). It shipped in the upstream release TuxCare onboarded, so the vulnerable pattern is not present in HEAD." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-11-06T11:32:00.041448+00:00", "status_notes": "Vulnerability CVE-2025-32395 does not affect version 5.4.21 of vite. not_affected \u2014 Vite 5.4.21 already contains the upstream fix for CVE-2025-32395. A middleware rejects any request whose req.url contains '#' with a 400 before the fs.deny and fs.allow checks run. The fix commit is upstream-authored and shipped in the release TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32395" }, "impact_statement": "not_affected \u2014 Vite 5.4.21 already contains the upstream fix for CVE-2025-32395. A middleware rejects any request whose req.url contains '#' with a 400 before the fs.deny and fs.allow checks run. The fix commit is upstream-authored and shipped in the release TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-46565 does not affect version 5.4.21 of vite. already_fixed \u2014 The target repository vite@5.4.21-tuxcare.1 already contains the fix for CVE-2025-46565. The vulnerability (bypassing server.fs.deny patterns using /.env/. style paths) was addressed in commit 766947e7c on April 30, 2025, which is an ancestor of the current HEAD (5e772c54d).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46565" }, "impact_statement": "already_fixed \u2014 The target repository vite@5.4.21-tuxcare.1 already contains the fix for CVE-2025-46565. The vulnerability (bypassing server.fs.deny patterns using /.env/. style paths) was addressed in commit 766947e7c on April 30, 2025, which is an ancestor of the current HEAD (5e772c54d)." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58751 does not affect version 5.4.21 of vite. already_fixed \u2014 The target Vite 5.4.21-tuxcare.1 already contains the complete fix for CVE-2025-58751. The upstream Vite v5.4.21 release included both critical patches: the sirv@2.0.4 library patch that enforces directory path separator validation to prevent prefix confusion attacks, and the HTML middleware enhancements that add filesystem access checks. These fixes prevent path traversal attacks that could by...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58751" }, "impact_statement": "already_fixed \u2014 The target Vite 5.4.21-tuxcare.1 already contains the complete fix for CVE-2025-58751. The upstream Vite v5.4.21 release included both critical patches: the sirv@2.0.4 library patch that enforces directory path separator validation to prevent prefix confusion attacks, and the HTML middleware enhancements that add filesystem access checks. These fixes prevent path traversal attacks that could by..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58752 does not affect version 5.4.21 of vite. already_fixed \u2014 The target repository (Vite 5.4.21-tuxcare.1) already contains the fix for CVE-2025-58752. The vulnerability allowed arbitrary HTML files on the filesystem to be served regardless of server.fs allow/deny settings. The fix was introduced in upstream Vite v5.4.20 (commit 482000f57) and is present in the target version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58752" }, "impact_statement": "already_fixed \u2014 The target repository (Vite 5.4.21-tuxcare.1) already contains the fix for CVE-2025-58752. The vulnerability allowed arbitrary HTML files on the filesystem to be served regardless of server.fs allow/deny settings. The fix was introduced in upstream Vite v5.4.20 (commit 482000f57) and is present in the target version." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62522 does not affect version 5.4.21 of vite. already_fixed \u2014 CVE-2025-62522 has already been fixed in the target repository. The fix commit cad1d31d0 ('fix(dev): trim trailing slash before `server.fs.deny` check') is an ancestor of the target SHA 5e772c54d, and the defense logic is present in the code at packages/vite/src/node/server/middlewares/static.ts lines 262-267.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62522" }, "impact_statement": "already_fixed \u2014 CVE-2025-62522 has already been fixed in the target repository. The fix commit cad1d31d0 ('fix(dev): trim trailing slash before `server.fs.deny` check') is an ancestor of the target SHA 5e772c54d, and the defense logic is present in the code at packages/vite/src/node/server/middlewares/static.ts lines 262-267." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-10-20T19:57:00.094462+00:00", "status_notes": "Vulnerability CVE-2026-112942 affects version 5.4.21 of vite.", "vulnerability": { "name": "CVE-2026-112942" }, "action_statement": "Vulnerability CVE-2026-112942 affects version 5.4.21 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-10-21T09:14:00.089382+00:00", "status_notes": "Vulnerability CVE-2026-112943 does not affect version 5.4.21 of vite. not_affected \u2014 CVE-2026-112943 concerns the launch-editor package, which fails to escape `%` characters on Windows when passing arguments to cmd.exe, enabling command injection. The target repository (Vite v5.4.21-tuxcare.2) declares launch-editor-middleware@2.9.1 as a dependency, which transitively depends on launch-editor@2.9.1. However, the vulnerable code pattern (the missing `%` escaping logic) is NOT pr...", "vulnerability": { "name": "CVE-2026-112943" }, "impact_statement": "not_affected \u2014 CVE-2026-112943 concerns the launch-editor package, which fails to escape `%` characters on Windows when passing arguments to cmd.exe, enabling command injection. The target repository (Vite v5.4.21-tuxcare.2) declares launch-editor-middleware@2.9.1 as a dependency, which transitively depends on launch-editor@2.9.1. However, the vulnerable code pattern (the missing `%` escaping logic) is NOT pr..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-10-20T19:57:00.094462+00:00", "status_notes": "Vulnerability CVE-2026-112944 affects version 5.4.21 of vite.", "vulnerability": { "name": "CVE-2026-112944" }, "action_statement": "Vulnerability CVE-2026-112944 affects version 5.4.21 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-10-21T16:56:00.092611+00:00", "status_notes": "Vulnerability CVE-2026-112945 affects version 5.4.21 of vite.", "vulnerability": { "name": "CVE-2026-112945" }, "action_statement": "Vulnerability CVE-2026-112945 affects version 5.4.21 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-10-21T16:56:40.126672+00:00", "status_notes": "Vulnerability CVE-2026-112946 affects version 5.4.21 of vite.", "vulnerability": { "name": "CVE-2026-112946" }, "action_statement": "Vulnerability CVE-2026-112946 affects version 5.4.21 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-11-04T02:53:59.455645+00:00", "status_notes": "Vulnerability CVE-2026-112947 does not affect version 5.4.21 of vite. not_affected \u2014 The target version (Vite 5.4.21-tuxcare.4) is not affected by CVE-2026-112947. The vulnerability requires the `?vite-wasm-instance` query parameter handling feature, which was introduced in Vite v8.1.0 (commit c23d85b96, June 2026). The target is based on upstream v5.4.21, which predates this feature by several major versions. The vulnerable code path does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112947" }, "impact_statement": "not_affected \u2014 The target version (Vite 5.4.21-tuxcare.4) is not affected by CVE-2026-112947. The vulnerability requires the `?vite-wasm-instance` query parameter handling feature, which was introduced in Vite v8.1.0 (commit c23d85b96, June 2026). The target is based on upstream v5.4.21, which predates this feature by several major versions. The vulnerable code path does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-11-03T20:53:17.793537+00:00", "status_notes": "Vulnerability CVE-2026-118662 does not affect version 5.4.21 of vite. not_affected \u2014 CVE-2026-118662 / GHSA-v2wj-q39q-566r is specific to the refactored code introduced in PR #20410, which moved deny-checking logic to a different location in the request pipeline. Version 5.4.21 does not contain PR #20410, so it uses the old implementation with `deniedServingAccessForTransform` that checks deny patterns before file transformation. The vulnerability pattern described in this CVE\u2014...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-118662" }, "impact_statement": "not_affected \u2014 CVE-2026-118662 / GHSA-v2wj-q39q-566r is specific to the refactored code introduced in PR #20410, which moved deny-checking logic to a different location in the request pipeline. Version 5.4.21 does not contain PR #20410, so it uses the old implementation with `deniedServingAccessForTransform` that checks deny patterns before file transformation. The vulnerability pattern described in this CVE\u2014..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39363 does not affect version 5.4.21 of vite. not_affected \u2014 The target version (Vite 5.4.21-tuxcare.1) is not affected by CVE-2026-39363. The vulnerability exploits the Environment API architecture (DevEnvironment class, HotChannel interface, and vite:invoke WebSocket protocol) that was introduced in Vite 5.5+. Version 5.4.21 uses an older architecture where these components do not exist.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-39363" }, "impact_statement": "not_affected \u2014 The target version (Vite 5.4.21-tuxcare.1) is not affected by CVE-2026-39363. The vulnerability exploits the Environment API architecture (DevEnvironment class, HotChannel interface, and vite:invoke WebSocket protocol) that was introduced in Vite 5.5+. Version 5.4.21 uses an older architecture where these components do not exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39364 does not affect version 5.4.21 of vite. not_affected \u2014 The target version (Vite 5.4.21) is not affected by CVE-2026-39364. While the CVE affects versions 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4, the target uses a fundamentally different architecture for access control that includes automatic query parameter stripping before deny-list pattern matching, preventing the vulnerability mechanism from manifesting.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39364" }, "impact_statement": "not_affected \u2014 The target version (Vite 5.4.21) is not affected by CVE-2026-39364. While the CVE affects versions 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4, the target uses a fundamentally different architecture for access control that includes automatic query parameter stripping before deny-list pattern matching, preventing the vulnerability mechanism from manifesting." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39365 affects version 5.4.21 of vite, and is fixed in 5.4.21-tuxcare.1.", "vulnerability": { "name": "CVE-2026-39365" }, "action_statement": "Vulnerability CVE-2026-39365 affects version 5.4.21 of vite, and is fixed in 5.4.21-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53571 affects version 5.4.21 of vite, and is fixed in 5.4.21-tuxcare.2.", "vulnerability": { "name": "CVE-2026-53571" }, "action_statement": "Vulnerability CVE-2026-53571 affects version 5.4.21 of vite, and is fixed in 5.4.21-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.21", "identifiers": { "purl": "pkg:npm/vite@5.4.21" } } ], "timestamp": "2026-10-23T13:47:26.946672+00:00", "status_notes": "Vulnerability CVE-2026-53632 affects version 5.4.21 of vite, and is fixed in 5.4.21-tuxcare.3.", "vulnerability": { "name": "CVE-2026-53632" }, "action_statement": "Vulnerability CVE-2026-53632 affects version 5.4.21 of vite, and is fixed in 5.4.21-tuxcare.3." } ] }