{ "@id": "urn:uuid:f68f76cf-78cb-466c-8be5-c3d7e3ba463e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 23, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T22:34:00.065751+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 8.0.12-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 8.0.12-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 8.0.12-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 8.0.12-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-49293 affects version 8.0.12-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2023-49293" }, "action_statement": "Vulnerability CVE-2023-49293 affects version 8.0.12-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-23331 affects version 8.0.12-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2024-23331" }, "action_statement": "Vulnerability CVE-2024-23331 affects version 8.0.12-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-03T23:47:00.044788+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 8.0.12-tuxcare.2 of vite. not_affected \u2014 CVE-2024-31207 fix is already present in target version 8.0.12-tuxcare.2. The fix was shipped in the upstream Vite release before TuxCare onboarded it. The vulnerable picomatch configuration (matchBase: true without dot: true) has been replaced with the correct configuration (matchBase: false, dot: true, with pattern transformation) in packages/vite/src/node/config.ts lines 2006-2018. Fix commi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "not_affected \u2014 CVE-2024-31207 fix is already present in target version 8.0.12-tuxcare.2. The fix was shipped in the upstream Vite release before TuxCare onboarded it. The vulnerable picomatch configuration (matchBase: true without dot: true) has been replaced with the correct configuration (matchBase: false, dot: true, with pattern transformation) in packages/vite/src/node/config.ts lines 2006-2018. Fix commi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-03T23:52:00.070015+00:00", "status_notes": "Vulnerability CVE-2024-45811 does not affect version 8.0.12-tuxcare.2 of vite. not_affected \u2014 The target (Vite 8.0.12-tuxcare.2) is not affected by CVE-2024-45811. The vulnerability allowed arbitrary file reading via `@fs` endpoints by appending `?import&raw` to bypass access controls. The fix was already present in the upstream v8.0.12 release when TuxCare onboarded it. The defense validates access for `?raw` and `?url` requests via `isServerAccessDeniedForTransform()` called from `tra...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45811" }, "impact_statement": "not_affected \u2014 The target (Vite 8.0.12-tuxcare.2) is not affected by CVE-2024-45811. The vulnerability allowed arbitrary file reading via `@fs` endpoints by appending `?import&raw` to bypass access controls. The fix was already present in the upstream v8.0.12 release when TuxCare onboarded it. The defense validates access for `?raw` and `?url` requests via `isServerAccessDeniedForTransform()` called from `tra..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-13T22:34:00.065751+00:00", "status_notes": "Vulnerability CVE-2024-45812 does not affect version 8.0.12-tuxcare.2 of vite. not_affected \u2014 Vite 8.0.12 already contains the CVE-2024-45812 fix. getRelativeUrlFromDocument in packages/vite/src/node/build.ts only uses document.currentScript.src when currentScript.tagName is SCRIPT, and otherwise falls back to document.baseURI. The fix is the upstream commit ade1d89660e1 (author thisiszhengyu@gmail.com, committer GitHub). It predates the first TuxCare commit in this branch's history, so...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45812" }, "impact_statement": "not_affected \u2014 Vite 8.0.12 already contains the CVE-2024-45812 fix. getRelativeUrlFromDocument in packages/vite/src/node/build.ts only uses document.currentScript.src when currentScript.tagName is SCRIPT, and otherwise falls back to document.baseURI. The fix is the upstream commit ade1d89660e1 (author thisiszhengyu@gmail.com, committer GitHub). It predates the first TuxCare commit in this branch's history, so..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-52011 affects version 8.0.12-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2024-52011" }, "action_statement": "Vulnerability CVE-2024-52011 affects version 8.0.12-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-03T23:58:45.680561+00:00", "status_notes": "Vulnerability CVE-2025-24010 does not affect version 8.0.12-tuxcare.2 of vite. not_affected \u2014 The target (Vite 8.0.12-tuxcare.2) is NOT AFFECTED by CVE-2025-24010. All three security defenses addressing this CVE were shipped in the upstream Vite 8.0.12 release (May 11, 2026) before TuxCare onboarded it. The fixes include: (1) WebSocket token validation to prevent Cross-Site WebSocket Hijacking (commit 029dcd6d7), (2) CORS restriction to loopback origins only to prevent source code theft...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24010" }, "impact_statement": "not_affected \u2014 The target (Vite 8.0.12-tuxcare.2) is NOT AFFECTED by CVE-2025-24010. All three security defenses addressing this CVE were shipped in the upstream Vite 8.0.12 release (May 11, 2026) before TuxCare onboarded it. The fixes include: (1) WebSocket token validation to prevent Cross-Site WebSocket Hijacking (commit 029dcd6d7), (2) CORS restriction to loopback origins only to prevent source code theft..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-06T11:26:42.233420+00:00", "status_notes": "Vulnerability CVE-2025-30208 does not affect version 8.0.12-tuxcare.2 of vite. not_affected \u2014 The target (vite 8.0.12) already contains the upstream fix for CVE-2025-30208. The fs-access check in the transform path uses separator-tolerant regexes (`[?&]raw\\b`, `[?&]url\\b`), so `?import&raw??` is denied for files outside the allow list. The fix shipped in the upstream release, before the first TuxCare commit, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-30208" }, "impact_statement": "not_affected \u2014 The target (vite 8.0.12) already contains the upstream fix for CVE-2025-30208. The fs-access check in the transform path uses separator-tolerant regexes (`[?&]raw\\b`, `[?&]url\\b`), so `?import&raw??` is denied for files outside the allow list. The fix shipped in the upstream release, before the first TuxCare commit, so the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-06T11:26:42.233420+00:00", "status_notes": "Vulnerability CVE-2025-31125 does not affect version 8.0.12-tuxcare.2 of vite. not_affected \u2014 Vite 8.0.12 already contains the upstream fix for CVE-2025-31125 (commit 59673137 \"fix: fs check in transform middleware (#19761)\"). That commit was authored by patak-dev (upstream) and was committed before the first TuxCare commit. The fs access check now runs on ?raw, ?url, ?inline and .svg ids before the file is loaded, so the ?inline&import and ?raw?import bypasses no longer work.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31125" }, "impact_statement": "not_affected \u2014 Vite 8.0.12 already contains the upstream fix for CVE-2025-31125 (commit 59673137 \"fix: fs check in transform middleware (#19761)\"). That commit was authored by patak-dev (upstream) and was committed before the first TuxCare commit. The fs access check now runs on ?raw, ?url, ?inline and .svg ids before the file is loaded, so the ?inline&import and ?raw?import bypasses no longer work." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-06T11:32:00.041448+00:00", "status_notes": "Vulnerability CVE-2025-31486 does not affect version 8.0.12-tuxcare.2 of vite. not_affected \u2014 Not affected. The target is vite 8.0.12-tuxcare.2. The upstream fix for CVE-2025-31486 (62d7e81ee, \"fix: fs check with svg and relative paths (#19782)\", by patak) is already in the upstream 8.0.12 release, before the first TuxCare commit. The fs access check now runs on the resolved id before any plugin load, and it covers .svg ids and checks both the cleaned and the raw id.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31486" }, "impact_statement": "not_affected \u2014 Not affected. The target is vite 8.0.12-tuxcare.2. The upstream fix for CVE-2025-31486 (62d7e81ee, \"fix: fs check with svg and relative paths (#19782)\", by patak) is already in the upstream 8.0.12 release, before the first TuxCare commit. The fs access check now runs on the resolved id before any plugin load, and it covers .svg ids and checks both the cleaned and the raw id." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-06T11:39:00.034682+00:00", "status_notes": "Vulnerability CVE-2025-32395 does not affect version 8.0.12-tuxcare.2 of vite. not_affected \u2014 Not affected. The upstream fix for CVE-2025-32395 (commit 175a83909f, \"reject requests with `#` in request-target (#19830)\") is already in the Vite 8.0.12 release that TuxCare onboarded. rejectInvalidRequestMiddleware returns 400 for any req.url containing '#' and is registered first in the dev-server middleware chain, so such a request never reaches the fs.deny checks or file serving.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32395" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2025-32395 (commit 175a83909f, \"reject requests with `#` in request-target (#19830)\") is already in the Vite 8.0.12 release that TuxCare onboarded. rejectInvalidRequestMiddleware returns 400 for any req.url containing '#' and is registered first in the dev-server middleware chain, so such a request never reaches the fs.deny checks or file serving." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-03T23:59:00.053776+00:00", "status_notes": "Vulnerability CVE-2025-46565 does not affect version 8.0.12-tuxcare.2 of vite. not_affected \u2014 CVE-2025-46565 affects Vite dev server file serving via path traversal using `/.` to bypass server.fs.deny patterns (e.g., `/.env/.` bypasses `.env` deny pattern). The target repository (Vite 8.0.12-tuxcare.2) contains the upstream vendor fix from commit c22c43de612eebb6c182dd67850c24e4fab8cacb, which was already present in the upstream Vite 8.0.12 release before TuxCare onboarded it. The fix a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46565" }, "impact_statement": "not_affected \u2014 CVE-2025-46565 affects Vite dev server file serving via path traversal using `/.` to bypass server.fs.deny patterns (e.g., `/.env/.` bypasses `.env` deny pattern). The target repository (Vite 8.0.12-tuxcare.2) contains the upstream vendor fix from commit c22c43de612eebb6c182dd67850c24e4fab8cacb, which was already present in the upstream Vite 8.0.12 release before TuxCare onboarded it. The fix a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-04T00:13:40.491609+00:00", "status_notes": "Vulnerability CVE-2025-58751 does not affect version 8.0.12-tuxcare.2 of vite. not_affected \u2014 The target repository (Vite 8.0.12-tuxcare.2) is not affected by CVE-2025-58751. The vulnerability fix was already present in the upstream Vite v8.0.12 release (released May 11, 2026), which TuxCare onboarded. The fix includes: (1) sirv library upgrade to 3.0.2 with proper path separator validation (commit 09f2b52e8), and (2) HTML file serving validation against server.fs settings (commit 14015...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58751" }, "impact_statement": "not_affected \u2014 The target repository (Vite 8.0.12-tuxcare.2) is not affected by CVE-2025-58751. The vulnerability fix was already present in the upstream Vite v8.0.12 release (released May 11, 2026), which TuxCare onboarded. The fix includes: (1) sirv library upgrade to 3.0.2 with proper path separator validation (commit 09f2b52e8), and (2) HTML file serving validation against server.fs settings (commit 14015..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-04T00:18:00.108404+00:00", "status_notes": "Vulnerability CVE-2025-58752 does not affect version 8.0.12-tuxcare.2 of vite. not_affected \u2014 The target repository (Vite 8.0.12-tuxcare.2) is not affected by CVE-2025-58752. Both vulnerability fixes (HTML file serving access control bypass and sourcemap handler path traversal) were already present in the upstream release v8.0.12 before TuxCare onboarded this version. The fixes were authored by upstream developer green@sapphi.red and shipped in the upstream release, not added by TuxCare...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58752" }, "impact_statement": "not_affected \u2014 The target repository (Vite 8.0.12-tuxcare.2) is not affected by CVE-2025-58752. Both vulnerability fixes (HTML file serving access control bypass and sourcemap handler path traversal) were already present in the upstream release v8.0.12 before TuxCare onboarded this version. The fixes were authored by upstream developer green@sapphi.red and shipped in the upstream release, not added by TuxCare..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-04T00:18:30.099191+00:00", "status_notes": "Vulnerability CVE-2025-62522 does not affect version 8.0.12-tuxcare.2 of vite. not_affected \u2014 CVE-2025-62522 is not present in target version 8.0.12-tuxcare.2. The vulnerability allowed bypassing server.fs.deny restrictions by appending trailing slashes to URLs, but the fix (stripping trailing slashes before deny pattern checks) was already included in the upstream Vite v8.0.12 release. The fix is present at lines 315-320 of packages/vite/src/node/server/middlewares/static.ts. All file ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62522" }, "impact_statement": "not_affected \u2014 CVE-2025-62522 is not present in target version 8.0.12-tuxcare.2. The vulnerability allowed bypassing server.fs.deny restrictions by appending trailing slashes to URLs, but the fix (stripping trailing slashes before deny pattern checks) was already included in the upstream Vite v8.0.12 release. The fix is present at lines 315-320 of packages/vite/src/node/server/middlewares/static.ts. All file ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-10-27T11:06:49.081771+00:00", "status_notes": "Vulnerability CVE-2026-112942 affects version 8.0.12-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-112942" }, "action_statement": "Vulnerability CVE-2026-112942 affects version 8.0.12-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-10-27T11:06:49.081771+00:00", "status_notes": "Vulnerability CVE-2026-112943 affects version 8.0.12-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-112943" }, "action_statement": "Vulnerability CVE-2026-112943 affects version 8.0.12-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-10-27T11:06:49.081771+00:00", "status_notes": "Vulnerability CVE-2026-112944 affects version 8.0.12-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-112944" }, "action_statement": "Vulnerability CVE-2026-112944 affects version 8.0.12-tuxcare.2 of vite." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-10-27T11:07:00.487700+00:00", "status_notes": "Vulnerability CVE-2026-112945 is fixed in version 8.0.12-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-112945" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-10-27T11:07:00.487700+00:00", "status_notes": "Vulnerability CVE-2026-112946 is fixed in version 8.0.12-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-112946" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-04T02:57:55.193411+00:00", "status_notes": "Vulnerability CVE-2026-112947 does not affect version 8.0.12-tuxcare.2 of vite. not_affected \u2014 Target version 8.0.12-tuxcare.2 is NOT AFFECTED. The vulnerability requires the vite-wasm-instance query parameter handling feature, which was introduced in Vite v8.2.0-beta.0 (commit 9e79b5157, July 2026). The target version 8.0.12 (released before v8.2.0) does not contain this feature. The vulnerable code path\u2014where requests with ?vite-wasm-instance bypass server.fs checks and trigger WebAsse...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112947" }, "impact_statement": "not_affected \u2014 Target version 8.0.12-tuxcare.2 is NOT AFFECTED. The vulnerability requires the vite-wasm-instance query parameter handling feature, which was introduced in Vite v8.2.0-beta.0 (commit 9e79b5157, July 2026). The target version 8.0.12 (released before v8.2.0) does not contain this feature. The vulnerable code path\u2014where requests with ?vite-wasm-instance bypass server.fs checks and trigger WebAsse..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-03T20:48:00.093952+00:00", "status_notes": "Vulnerability CVE-2026-118662 does not affect version 8.0.12-tuxcare.2 of vite. not_affected \u2014 CVE-2026-118662 concerns a bypass of `server.fs.deny` configuration in Vite dev server when query parameters (?raw, ?import&raw, ?import&url&inline) are appended to requests. The target (Vite 8.0.12-tuxcare.2) is NOT AFFECTED because the required fix from PR #22160 was already included in the upstream v8.0.12 release. The fix ensures both the cleaned URL (without query params) and the full URL ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-118662" }, "impact_statement": "not_affected \u2014 CVE-2026-118662 concerns a bypass of `server.fs.deny` configuration in Vite dev server when query parameters (?raw, ?import&raw, ?import&url&inline) are appended to requests. The target (Vite 8.0.12-tuxcare.2) is NOT AFFECTED because the required fix from PR #22160 was already included in the upstream v8.0.12 release. The fix ensures both the cleaned URL (without query params) and the full URL ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-10-30T14:47:00.151806+00:00", "status_notes": "Vulnerability CVE-2026-39363 affects version 8.0.12-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-39363" }, "action_statement": "Vulnerability CVE-2026-39363 affects version 8.0.12-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-10-30T14:48:00.154664+00:00", "status_notes": "Vulnerability CVE-2026-39364 affects version 8.0.12-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-39364" }, "action_statement": "Vulnerability CVE-2026-39364 affects version 8.0.12-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-11-06T11:41:00.041305+00:00", "status_notes": "Vulnerability CVE-2026-39365 does not affect version 8.0.12-tuxcare.2 of vite. not_affected \u2014 Vite 8.0.12 already contains the upstream fix for CVE-2026-39365. The optimized-deps .map handler in transform.ts rejects any resolved path that is not inside the deps cache dir before reading it. The fix is upstream commit 79f002f22 (#22161, author green@sapphi.red). That commit is an ancestor of HEAD and of the first TuxCare commit, so it shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39365" }, "impact_statement": "not_affected \u2014 Vite 8.0.12 already contains the upstream fix for CVE-2026-39365. The optimized-deps .map handler in transform.ts rejects any resolved path that is not inside the deps cache dir before reading it. The fix is upstream commit 79f002f22 (#22161, author green@sapphi.red). That commit is an ancestor of HEAD and of the first TuxCare commit, so it shipped in the upstream release." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-10-27T11:06:49.081771+00:00", "status_notes": "Vulnerability CVE-2026-53571 is fixed in version 8.0.12-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-53571" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@8.0.12-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.12-tuxcare.2" } } ], "timestamp": "2026-10-27T11:06:49.081771+00:00", "status_notes": "Vulnerability CVE-2026-53632 is fixed in version 8.0.12-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-53632" } } ] }