{ "@id": "urn:uuid:1548f5d2-ae09-40ae-aca7-6cc2381eee28", "role": "Document Creator", "author": "https://tuxcare.com", "version": 25, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T11:41:00.041305+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 7.3.7 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 7.3.7 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 7.3.7 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 7.3.7 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-49293 affects version 7.3.7 of vite.", "vulnerability": { "name": "CVE-2023-49293" }, "action_statement": "Vulnerability CVE-2023-49293 affects version 7.3.7 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-23331 affects version 7.3.7 of vite.", "vulnerability": { "name": "CVE-2024-23331" }, "action_statement": "Vulnerability CVE-2024-23331 affects version 7.3.7 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-03T23:50:59.896905+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 7.3.7 of vite. not_affected \u2014 CVE-2024-31207 affects Vite's server.fs.deny option when using patterns with directory components (e.g., **/.git/**). The vulnerability stemmed from picomatch's matchBase:true setting only matching basenames, not full paths, and missing dot:true for dotfiles. The target repository (Vite 7.3.7) already contains the upstream fix authored by green@sapphi.red (commit ba5269cca, March 24, 2024) whic...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "not_affected \u2014 CVE-2024-31207 affects Vite's server.fs.deny option when using patterns with directory components (e.g., **/.git/**). The vulnerability stemmed from picomatch's matchBase:true setting only matching basenames, not full paths, and missing dot:true for dotfiles. The target repository (Vite 7.3.7) already contains the upstream fix authored by green@sapphi.red (commit ba5269cca, March 24, 2024) whic..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-45811 affects version 7.3.7 of vite.", "vulnerability": { "name": "CVE-2024-45811" }, "action_statement": "Vulnerability CVE-2024-45811 affects version 7.3.7 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-45812 affects version 7.3.7 of vite.", "vulnerability": { "name": "CVE-2024-45812" }, "action_statement": "Vulnerability CVE-2024-45812 affects version 7.3.7 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-52011 affects version 7.3.7 of vite.", "vulnerability": { "name": "CVE-2024-52011" }, "action_statement": "Vulnerability CVE-2024-52011 affects version 7.3.7 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-04T00:04:00.138194+00:00", "status_notes": "Vulnerability CVE-2025-24010 does not affect version 7.3.7 of vite. not_affected \u2014 Vite 7.3.7 is not affected by CVE-2025-24010. All three attack vectors described in the CVE have been fixed by the upstream Vite project prior to the v7.3.7 release: (1) WebSocket connections now require cryptographic token validation, (2) CORS is restricted to loopback origins only by default, and (3) Host header validation prevents DNS rebinding attacks. These fixes were authored by upstream ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24010" }, "impact_statement": "not_affected \u2014 Vite 7.3.7 is not affected by CVE-2025-24010. All three attack vectors described in the CVE have been fixed by the upstream Vite project prior to the v7.3.7 release: (1) WebSocket connections now require cryptographic token validation, (2) CORS is restricted to loopback origins only by default, and (3) Host header validation prevents DNS rebinding attacks. These fixes were authored by upstream ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-06T11:25:00.048413+00:00", "status_notes": "Vulnerability CVE-2025-30208 does not affect version 7.3.7 of vite. not_affected \u2014 Vite 7.3.7 already contains the upstream fix for CVE-2025-30208. The transform-time access check uses word-boundary regexes (/[?&]raw\\b/, /[?&]url\\b/), so `?raw??` and `?import&raw??` can no longer slip past the fs allow-list check. The fix shipped in the upstream release and was not authored by TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-30208" }, "impact_statement": "not_affected \u2014 Vite 7.3.7 already contains the upstream fix for CVE-2025-30208. The transform-time access check uses word-boundary regexes (/[?&]raw\\b/, /[?&]url\\b/), so `?raw??` and `?import&raw??` can no longer slip past the fs allow-list check. The fix shipped in the upstream release and was not authored by TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-06T11:30:06.317055+00:00", "status_notes": "Vulnerability CVE-2025-31125 does not affect version 7.3.7 of vite. not_affected \u2014 Vite 7.3.7 already contains the upstream fix for CVE-2025-31125 (commit 59673137, \"fix: fs check in transform middleware (#19761)\", authored by patak-dev, committed via GitHub). The transform path applies the server.fs check to ?raw, ?url, ?inline and .svg ids, on both the cleaned URL and the full id, before the file is loaded. The fix shipped in the upstream release, and HEAD has no commit by ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31125" }, "impact_statement": "not_affected \u2014 Vite 7.3.7 already contains the upstream fix for CVE-2025-31125 (commit 59673137, \"fix: fs check in transform middleware (#19761)\", authored by patak-dev, committed via GitHub). The transform path applies the server.fs check to ?raw, ?url, ?inline and .svg ids, on both the cleaned URL and the full id, before the file is loaded. The fix shipped in the upstream release, and HEAD has no commit by ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-06T11:33:00.046652+00:00", "status_notes": "Vulnerability CVE-2025-31486 does not affect version 7.3.7 of vite. not_affected \u2014 Vite 7.3.7 already contains the upstream fix for CVE-2025-31486 (commit 62d7e81, \"fix: fs check with svg and relative paths (#19782)\", by patak-dev). It is an ancestor of HEAD and part of the upstream release. The server.fs check now runs in loadAndTransform on the normalized id, and it also covers ids containing `.svg` anywhere (including `?.svg`), so both PoCs are blocked. The fix is not TuxC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31486" }, "impact_statement": "not_affected \u2014 Vite 7.3.7 already contains the upstream fix for CVE-2025-31486 (commit 62d7e81, \"fix: fs check with svg and relative paths (#19782)\", by patak-dev). It is an ancestor of HEAD and part of the upstream release. The server.fs check now runs in loadAndTransform on the normalized id, and it also covers ids containing `.svg` anywhere (including `?.svg`), so both PoCs are blocked. The fix is not TuxC..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-06T11:39:00.034682+00:00", "status_notes": "Vulnerability CVE-2025-32395 does not affect version 7.3.7 of vite. not_affected \u2014 Vite 7.3.7 already contains the upstream fix for CVE-2025-32395. A middleware rejects any request whose req.url contains '#' with a 400 before the cors, host-check, and static/fs middlewares run. The fix commit 175a83909 is by the upstream author (green@sapphi.red) and was part of the upstream release, with no TuxCare commit in HEAD's history.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32395" }, "impact_statement": "not_affected \u2014 Vite 7.3.7 already contains the upstream fix for CVE-2025-32395. A middleware rejects any request whose req.url contains '#' with a 400 before the cors, host-check, and static/fs middlewares run. The fix commit 175a83909 is by the upstream author (green@sapphi.red) and was part of the upstream release, with no TuxCare commit in HEAD's history." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-04T00:02:20.881881+00:00", "status_notes": "Vulnerability CVE-2025-46565 does not affect version 7.3.7 of vite. not_affected \u2014 The target (Vite 7.3.7) is not affected by CVE-2025-46565. The vulnerability allowed bypassing server.fs.deny patterns using requests with /. path patterns (e.g., /.env/.) to read denied files under the project root. The fix (commit c22c43de) was already present in the upstream Vite v7.3.7 release. The fix adds a shouldServe callback inside sirv that validates the resolved file path against den...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46565" }, "impact_statement": "not_affected \u2014 The target (Vite 7.3.7) is not affected by CVE-2025-46565. The vulnerability allowed bypassing server.fs.deny patterns using requests with /. path patterns (e.g., /.env/.) to read denied files under the project root. The fix (commit c22c43de) was already present in the upstream Vite v7.3.7 release. The fix adds a shouldServe callback inside sirv that validates the resolved file path against den..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-04T00:10:42.275498+00:00", "status_notes": "Vulnerability CVE-2025-58751 does not affect version 7.3.7 of vite. not_affected \u2014 CVE-2025-58751 fix is already present in Vite v7.3.7. The vulnerability allowed path traversal to bypass server.fs.deny settings when symlinks existed in the public directory, due to sirv's trailing-slash trimming causing startsWith() bypass. The complete fix (path normalization, checkLoadingAccess, isParentDirectory checks, and sirv@3.0.2 patch ensuring directory paths end with separator) was ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58751" }, "impact_statement": "not_affected \u2014 CVE-2025-58751 fix is already present in Vite v7.3.7. The vulnerability allowed path traversal to bypass server.fs.deny settings when symlinks existed in the public directory, due to sirv's trailing-slash trimming causing startsWith() bypass. The complete fix (path normalization, checkLoadingAccess, isParentDirectory checks, and sirv@3.0.2 patch ensuring directory paths end with separator) was ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-04T00:22:26.206300+00:00", "status_notes": "Vulnerability CVE-2025-58752 does not affect version 7.3.7 of vite. not_affected \u2014 The target (Vite v7.3.7) is not affected by CVE-2025-58752. The vulnerability pattern\u2014HTML files and sourcemaps served without server.fs access control checks\u2014is not present in the codebase. Both required fixes were applied by upstream Vite maintainers and shipped in the v7.3.7 release before TuxCare onboarded this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58752" }, "impact_statement": "not_affected \u2014 The target (Vite v7.3.7) is not affected by CVE-2025-58752. The vulnerability pattern\u2014HTML files and sourcemaps served without server.fs access control checks\u2014is not present in the codebase. Both required fixes were applied by upstream Vite maintainers and shipped in the v7.3.7 release before TuxCare onboarded this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-04T00:25:00.146670+00:00", "status_notes": "Vulnerability CVE-2025-62522 does not affect version 7.3.7 of vite. not_affected \u2014 CVE-2025-62522 is not present in Vite 7.3.7. The vulnerability (bypassing server.fs.deny patterns by appending trailing slashes/backslashes to file paths) was fixed in upstream commit f479cc57c, which shipped in Vite v7.1.11. The target version 7.3.7 includes this upstream fix. The defense code (lines 315-320 in static.ts) strips trailing slashes before applying deny pattern matching, preventin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62522" }, "impact_statement": "not_affected \u2014 CVE-2025-62522 is not present in Vite 7.3.7. The vulnerability (bypassing server.fs.deny patterns by appending trailing slashes/backslashes to file paths) was fixed in upstream commit f479cc57c, which shipped in Vite v7.1.11. The target version 7.3.7 includes this upstream fix. The defense code (lines 315-320 in static.ts) strips trailing slashes before applying deny pattern matching, preventin..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-10-31T13:22:29.205538+00:00", "status_notes": "Vulnerability CVE-2026-112942 affects version 7.3.7 of vite.", "vulnerability": { "name": "CVE-2026-112942" }, "action_statement": "Vulnerability CVE-2026-112942 affects version 7.3.7 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-04T02:50:04.890115+00:00", "status_notes": "Vulnerability CVE-2026-112943 does not affect version 7.3.7 of vite. not_affected \u2014 Vite 7.3.7 is not affected by CVE-2026-112943. The vulnerability exists in launch-editor versions prior to 2.14.2, which failed to escape '%' characters when passing file path arguments to cmd.exe on Windows. The target uses launch-editor-middleware@^2.14.2, which transitively depends on the fixed version launch-editor@2.14.2. The fix was applied by upstream Vite maintainers in commit a0a33391b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112943" }, "impact_statement": "not_affected \u2014 Vite 7.3.7 is not affected by CVE-2026-112943. The vulnerability exists in launch-editor versions prior to 2.14.2, which failed to escape '%' characters when passing file path arguments to cmd.exe on Windows. The target uses launch-editor-middleware@^2.14.2, which transitively depends on the fixed version launch-editor@2.14.2. The fix was applied by upstream Vite maintainers in commit a0a33391b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-04T02:52:11.477173+00:00", "status_notes": "Vulnerability CVE-2026-112944 does not affect version 7.3.7 of vite. not_affected \u2014 Vite 7.3.7 is NOT affected by CVE-2026-112944. The vulnerability concerns unsanitized file paths in launch-editor that could allow command injection when filenames start with '+' or '-'. The target already contains the fix via commit a0a33391b (Oct 6, 2026), which updated launch-editor-middleware from 2.14.1 to 2.14.2. Version 2.14.2 mitigates the vulnerability by converting all file paths to a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112944" }, "impact_statement": "not_affected \u2014 Vite 7.3.7 is NOT affected by CVE-2026-112944. The vulnerability concerns unsanitized file paths in launch-editor that could allow command injection when filenames start with '+' or '-'. The target already contains the fix via commit a0a33391b (Oct 6, 2026), which updated launch-editor-middleware from 2.14.1 to 2.14.2. Version 2.14.2 mitigates the vulnerability by converting all file paths to a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-04T02:53:59.455645+00:00", "status_notes": "Vulnerability CVE-2026-112945 does not affect version 7.3.7 of vite. not_affected \u2014 The target Vite v7.3.7 is not affected by CVE-2026-112945. The vulnerability fix shipped in the upstream v7.3.7 release that TuxCare onboarded. Both required defenses are present: (1) cleanUrl() strips query parameters before filesystem path operations at indexHtml.ts:108, preventing query-encoded path traversal; (2) protocol-relative URL normalization at lines 209-211 prevents scheme-relative ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112945" }, "impact_statement": "not_affected \u2014 The target Vite v7.3.7 is not affected by CVE-2026-112945. The vulnerability fix shipped in the upstream v7.3.7 release that TuxCare onboarded. Both required defenses are present: (1) cleanUrl() strips query parameters before filesystem path operations at indexHtml.ts:108, preventing query-encoded path traversal; (2) protocol-relative URL normalization at lines 209-211 prevents scheme-relative ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-04T02:52:11.477173+00:00", "status_notes": "Vulnerability CVE-2026-112946 does not affect version 7.3.7 of vite. not_affected \u2014 The target Vite 7.3.7 is not affected by CVE-2026-112946. The vulnerability (path confusion allowing host filesystem access via safeModulePaths) was fixed in upstream commit f0d76c7da13d (\"fix(server): store ids to `safeModulePaths` rather than URLs #23656\") by upstream author \u7fe0 . This fix shipped in the upstream v7.3.7 release that TuxCare onboarded, before any TuxCare modifi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112946" }, "impact_statement": "not_affected \u2014 The target Vite 7.3.7 is not affected by CVE-2026-112946. The vulnerability (path confusion allowing host filesystem access via safeModulePaths) was fixed in upstream commit f0d76c7da13d (\"fix(server): store ids to `safeModulePaths` rather than URLs #23656\") by upstream author \u7fe0 . This fix shipped in the upstream v7.3.7 release that TuxCare onboarded, before any TuxCare modifi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-04T02:57:25.095298+00:00", "status_notes": "Vulnerability CVE-2026-112947 does not affect version 7.3.7 of vite. not_affected \u2014 Vite v7.3.7 is not affected by CVE-2026-112947. The vulnerability requires the `vite-wasm-instance` query parameter feature, which was introduced in Vite 8.x (around v8.1.5, July 2026). Version 7.3.7 is from the 7.x maintenance branch and lacks this feature entirely. The wasm plugin in v7.3.7 has no code path to process `?vite-wasm-instance` queries, no server-side file reading for WASM parsing...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112947" }, "impact_statement": "not_affected \u2014 Vite v7.3.7 is not affected by CVE-2026-112947. The vulnerability requires the `vite-wasm-instance` query parameter feature, which was introduced in Vite 8.x (around v8.1.5, July 2026). Version 7.3.7 is from the 7.x maintenance branch and lacks this feature entirely. The wasm plugin in v7.3.7 has no code path to process `?vite-wasm-instance` queries, no server-side file reading for WASM parsing..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-03T20:50:43.786928+00:00", "status_notes": "Vulnerability CVE-2026-118662 does not affect version 7.3.7 of vite. not_affected \u2014 Vite v7.3.7 is not affected by CVE-2026-118662. The vulnerability allowed files blocked by `server.fs.deny` to be accessed via query parameters like `?raw`, `?import&raw`, or `?import&url&inline`. The CVE specifically states that v6.4.4 back-ported PR #20410 but NOT PR #22160, causing v6 to be vulnerable. However, v7.3.7 includes the complete fix from PR #22160 (commit f8103cc94), which was int...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-118662" }, "impact_statement": "not_affected \u2014 Vite v7.3.7 is not affected by CVE-2026-118662. The vulnerability allowed files blocked by `server.fs.deny` to be accessed via query parameters like `?raw`, `?import&raw`, or `?import&url&inline`. The CVE specifically states that v6.4.4 back-ported PR #20410 but NOT PR #22160, causing v6 to be vulnerable. However, v7.3.7 includes the complete fix from PR #22160 (commit f8103cc94), which was int..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-10-30T14:48:00.154664+00:00", "status_notes": "Vulnerability CVE-2026-39363 affects version 7.3.7 of vite.", "vulnerability": { "name": "CVE-2026-39363" }, "action_statement": "Vulnerability CVE-2026-39363 affects version 7.3.7 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-10-30T14:48:00.154664+00:00", "status_notes": "Vulnerability CVE-2026-39364 affects version 7.3.7 of vite.", "vulnerability": { "name": "CVE-2026-39364" }, "action_statement": "Vulnerability CVE-2026-39364 affects version 7.3.7 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-06T11:41:00.041305+00:00", "status_notes": "Vulnerability CVE-2026-39365 does not affect version 7.3.7 of vite. not_affected \u2014 Vite 7.3.7 already contains the upstream fix for CVE-2026-39365 (upstream commit 09d8c903b, \"avoid path traversal with optimize deps sourcemap handler\", #22161). The .map handler for optimized deps now rejects any resolved path that is not inside the deps cache directory, so a `../` URL cannot reach .map files outside it. The fix shipped in the upstream v7.3.7 release (284f6b58d) and was not au...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39365" }, "impact_statement": "not_affected \u2014 Vite 7.3.7 already contains the upstream fix for CVE-2026-39365 (upstream commit 09d8c903b, \"avoid path traversal with optimize deps sourcemap handler\", #22161). The .map handler for optimized deps now rejects any resolved path that is not inside the deps cache directory, so a `../` URL cannot reach .map files outside it. The fix shipped in the upstream v7.3.7 release (284f6b58d) and was not au..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-10-31T13:22:29.205538+00:00", "status_notes": "Vulnerability CVE-2026-53571 affects version 7.3.7 of vite.", "vulnerability": { "name": "CVE-2026-53571" }, "action_statement": "Vulnerability CVE-2026-53571 affects version 7.3.7 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.7", "identifiers": { "purl": "pkg:npm/vite@7.3.7" } } ], "timestamp": "2026-11-04T02:49:04.662574+00:00", "status_notes": "Vulnerability CVE-2026-53632 does not affect version 7.3.7 of vite. not_affected \u2014 Target Vite v7.3.7 is not affected by CVE-2026-53632. The vulnerability involved Windows path handling issues allowing bypass of file access restrictions via 8.3 short names (~), NTFS Alternate Data Streams (:), and UNC paths causing NTLM hash leakage. All three security fixes are present in the target: (1) Windows alternate path rejection in static.ts lines 302-313, (2) launch-editor-middlewar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53632" }, "impact_statement": "not_affected \u2014 Target Vite v7.3.7 is not affected by CVE-2026-53632. The vulnerability involved Windows path handling issues allowing bypass of file access restrictions via 8.3 short names (~), NTFS Alternate Data Streams (:), and UNC paths causing NTLM hash leakage. All three security fixes are present in the target: (1) Windows alternate path rejection in static.ts lines 302-313, (2) launch-editor-middlewar..." } ] }