{ "@id": "urn:uuid:803d1203-9788-46f0-b96e-03a3498d097e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 3, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T22:36:00.066677+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 8.0.16-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 8.0.16-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 8.0.16-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 8.0.16-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2023-49293 affects version 8.0.16-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2023-49293" }, "action_statement": "Vulnerability CVE-2023-49293 affects version 8.0.16-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2024-23331 affects version 8.0.16-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2024-23331" }, "action_statement": "Vulnerability CVE-2024-23331 affects version 8.0.16-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 8.0.16-tuxcare.2 of vite. not_affected \u2014 Vite 8.0.16 is not affected by CVE-2024-31207. The vulnerability in `server.fs.deny` glob pattern matching has been fixed by upstream commit 242f550eb4 (feat: Environment API), which shipped in the upstream v8.0.16 release before TuxCare onboarded it. The fix correctly configures picomatch with `matchBase: false` and `dot: true`, and converts bare patterns to `**/${pattern}` format, preventing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "not_affected \u2014 Vite 8.0.16 is not affected by CVE-2024-31207. The vulnerability in `server.fs.deny` glob pattern matching has been fixed by upstream commit 242f550eb4 (feat: Environment API), which shipped in the upstream v8.0.16 release before TuxCare onboarded it. The fix correctly configures picomatch with `matchBase: false` and `dot: true`, and converts bare patterns to `**/${pattern}` format, preventing ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2024-45811 does not affect version 8.0.16-tuxcare.2 of vite. not_affected \u2014 Vite 8.0.16 is NOT AFFECTED by CVE-2024-45811. The vulnerability (filesystem access control bypass via ?import&raw query parameters) was fixed in upstream Vite commit 9d2413c8b on 2024-09-16, authored by patak@users.noreply.github.com. This fix was already present in the upstream release when TuxCare onboarded version 8.0.16 (first TuxCare commit ef5a9ebf6 from 2026-08-12). The current code inc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45811" }, "impact_statement": "not_affected \u2014 Vite 8.0.16 is NOT AFFECTED by CVE-2024-45811. The vulnerability (filesystem access control bypass via ?import&raw query parameters) was fixed in upstream Vite commit 9d2413c8b on 2024-09-16, authored by patak@users.noreply.github.com. This fix was already present in the upstream release when TuxCare onboarded version 8.0.16 (first TuxCare commit ef5a9ebf6 from 2026-08-12). The current code inc..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-13T22:36:00.066677+00:00", "status_notes": "Vulnerability CVE-2024-45812 does not affect version 8.0.16-tuxcare.2 of vite. not_affected \u2014 Target vite 8.0.16 already contains the upstream fix for CVE-2024-45812 (upstream PR #18115). getRelativeUrlFromDocument in build.ts checks that document.currentScript.tagName is SCRIPT before using its src. The fix is an upstream commit by a non-TuxCare author and predates the first TuxCare commit, so it shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45812" }, "impact_statement": "not_affected \u2014 Target vite 8.0.16 already contains the upstream fix for CVE-2024-45812 (upstream PR #18115). getRelativeUrlFromDocument in build.ts checks that document.currentScript.tagName is SCRIPT before using its src. The fix is an upstream commit by a non-TuxCare author and predates the first TuxCare commit, so it shipped in the upstream release." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2024-52011 affects version 8.0.16-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2024-52011" }, "action_statement": "Vulnerability CVE-2024-52011 affects version 8.0.16-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2025-24010 does not affect version 8.0.16-tuxcare.2 of vite. not_affected \u2014 Vite 8.0.16 is not affected by CVE-2025-24010. All three security fixes (WebSocket token validation, CORS restriction to loopback addresses, and Host header validation) were already present in the upstream release v8.0.16. The fixes were authored by upstream maintainer sapphi-red and integrated into Vite between versions 6.0.8 and 6.0.9, well before the 8.0.16 release that TuxCare onboarded. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24010" }, "impact_statement": "not_affected \u2014 Vite 8.0.16 is not affected by CVE-2025-24010. All three security fixes (WebSocket token validation, CORS restriction to loopback addresses, and Host header validation) were already present in the upstream release v8.0.16. The fixes were authored by upstream maintainer sapphi-red and integrated into Vite between versions 6.0.8 and 6.0.9, well before the 8.0.16 release that TuxCare onboarded. Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2025-30208 does not affect version 8.0.16-tuxcare.2 of vite. not_affected \u2014 Vite 8.0.16 already contains the upstream fix for CVE-2025-30208. The upstream commit 59673137c (\"fix: fs check in transform middleware\", #19761) is an ancestor of HEAD and predates the first TuxCare commit. Query-detection regexes in the transform path are `[?&]raw\\b`, `[?&]url\\b` and `[?&]inline\\b`, so `?raw??` and `?import&raw??` are recognised. The serving-access check then runs on both the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-30208" }, "impact_statement": "not_affected \u2014 Vite 8.0.16 already contains the upstream fix for CVE-2025-30208. The upstream commit 59673137c (\"fix: fs check in transform middleware\", #19761) is an ancestor of HEAD and predates the first TuxCare commit. Query-detection regexes in the transform path are `[?&]raw\\b`, `[?&]url\\b` and `[?&]inline\\b`, so `?raw??` and `?import&raw??` are recognised. The serving-access check then runs on both the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2025-31125 does not affect version 8.0.16-tuxcare.2 of vite. not_affected \u2014 Vite 8.0.16 already contains the upstream fix for CVE-2025-31125. The fs-access check runs before module load for requests carrying raw, url, inline or svg markers, after ?import has been stripped. The fix commit 59673137c45a (upstream author patak-dev) was in the upstream release TuxCare onboarded, so the verdict is not_affected, not already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31125" }, "impact_statement": "not_affected \u2014 Vite 8.0.16 already contains the upstream fix for CVE-2025-31125. The fs-access check runs before module load for requests carrying raw, url, inline or svg markers, after ?import has been stripped. The fix commit 59673137c45a (upstream author patak-dev) was in the upstream release TuxCare onboarded, so the verdict is not_affected, not already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2025-31486 does not affect version 8.0.16-tuxcare.2 of vite. not_affected \u2014 Vite 8.0.16 already contains the upstream fix for CVE-2025-31486 (commit 62d7e81ee, \"fix: fs check with svg and relative paths (#19782)\"). The commit is an ancestor of HEAD. It predates the first TuxCare commit, so it shipped in the upstream release. Its author is upstream (583075+patak-dev@users.noreply.github.com) and its committer is noreply@github.com. The svg and relative-path bypasses are...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31486" }, "impact_statement": "not_affected \u2014 Vite 8.0.16 already contains the upstream fix for CVE-2025-31486 (commit 62d7e81ee, \"fix: fs check with svg and relative paths (#19782)\"). The commit is an ancestor of HEAD. It predates the first TuxCare commit, so it shipped in the upstream release. Its author is upstream (583075+patak-dev@users.noreply.github.com) and its committer is noreply@github.com. The svg and relative-path bypasses are..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2025-32395 does not affect version 8.0.16-tuxcare.2 of vite. not_affected \u2014 Vite 8.0.16 already contains the upstream fix for CVE-2025-32395. The fix is commit 175a83909 (author green@sapphi.red), which adds rejectInvalidRequestMiddleware. The middleware returns 400 for any request whose req.url contains '#', and it is registered in server/index.ts. The fix is in the upstream release, before the first TuxCare commit, so this is an upstream fix and not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32395" }, "impact_statement": "not_affected \u2014 Vite 8.0.16 already contains the upstream fix for CVE-2025-32395. The fix is commit 175a83909 (author green@sapphi.red), which adds rejectInvalidRequestMiddleware. The middleware returns 400 for any request whose req.url contains '#', and it is registered in server/index.ts. The fix is in the upstream release, before the first TuxCare commit, so this is an upstream fix and not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2025-46565 does not affect version 8.0.16-tuxcare.2 of vite. not_affected \u2014 The target Vite 8.0.16 is NOT AFFECTED by CVE-2025-46565. The vulnerability (bypass of server.fs.deny patterns via `/.` path manipulation) was fixed by upstream Vite in commit c22c43de612eebb6c182dd67850c24e4fab8cacb, which shipped in the upstream v8.0.16 release. The fix adds a `shouldServe` callback to sirv options that validates file access after path resolution inside the file server, preve...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46565" }, "impact_statement": "not_affected \u2014 The target Vite 8.0.16 is NOT AFFECTED by CVE-2025-46565. The vulnerability (bypass of server.fs.deny patterns via `/.` path manipulation) was fixed by upstream Vite in commit c22c43de612eebb6c182dd67850c24e4fab8cacb, which shipped in the upstream v8.0.16 release. The fix adds a `shouldServe` callback to sirv options that validates file access after path resolution inside the file server, preve..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2025-58751 does not affect version 8.0.16-tuxcare.2 of vite. not_affected \u2014 Vite 8.0.16 is not affected by CVE-2025-58751. The vulnerability (path traversal via public directory name prefix matching) was fixed by upstream Vite maintainers in commits 14015d794f69 (HTML access checks) and 09f2b52e8d59 (sirv 3.0.2 upgrade with trailing separator fix) before the v8.0.16 release. All security patches are present in the target: (1) sirv@3.0.2.patch applies dir.endsWith(sep) ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58751" }, "impact_statement": "not_affected \u2014 Vite 8.0.16 is not affected by CVE-2025-58751. The vulnerability (path traversal via public directory name prefix matching) was fixed by upstream Vite maintainers in commits 14015d794f69 (HTML access checks) and 09f2b52e8d59 (sirv 3.0.2 upgrade with trailing separator fix) before the v8.0.16 release. All security patches are present in the target: (1) sirv@3.0.2.patch applies dir.endsWith(sep) ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2025-58752 does not affect version 8.0.16-tuxcare.2 of vite. not_affected \u2014 The target repository already contains the fix for CVE-2025-58752. The fix (commit 14015d794) was authored by upstream Vite developer green@sapphi.red and shipped in the upstream v8.0.16 release that TuxCare onboarded. The vulnerable code pattern (HTML files served without fs.strict checks) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58752" }, "impact_statement": "not_affected \u2014 The target repository already contains the fix for CVE-2025-58752. The fix (commit 14015d794) was authored by upstream Vite developer green@sapphi.red and shipped in the upstream v8.0.16 release that TuxCare onboarded. The vulnerable code pattern (HTML files served without fs.strict checks) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2025-62522 does not affect version 8.0.16-tuxcare.2 of vite. not_affected \u2014 CVE-2025-62522 is NOT present in target version 8.0.16. The vulnerability allowed bypassing server.fs.deny patterns via trailing-slash URLs (e.g., `/.env\\`), enabling unauthorized file access on Windows dev servers. The upstream fix (commit f479cc57c425ed41ceb434fecebd63931b1ed4ed) normalizes paths by stripping trailing slashes before pattern matching. This fix was already present in the upstre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62522" }, "impact_statement": "not_affected \u2014 CVE-2025-62522 is NOT present in target version 8.0.16. The vulnerability allowed bypassing server.fs.deny patterns via trailing-slash URLs (e.g., `/.env\\`), enabling unauthorized file access on Windows dev servers. The upstream fix (commit f479cc57c425ed41ceb434fecebd63931b1ed4ed) normalizes paths by stripping trailing slashes before pattern matching. This fix was already present in the upstre..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2026-112942 does not affect version 8.0.16-tuxcare.2 of vite. not_affected \u2014 CVE-2026-112942 describes a vulnerability in the `launch-editor` package where `fs.existsSync()` can be bypassed on Windows using crafted paths ending in `\\\\..:line:column`, leading to OS command injection. Vite declares `launch-editor-middleware: ^2.14.1` as a dependency and exposes it at the `/__open-in-editor` endpoint. However, Vite's own source code does NOT contain the vulnerable pattern ...", "vulnerability": { "name": "CVE-2026-112942" }, "impact_statement": "not_affected \u2014 CVE-2026-112942 describes a vulnerability in the `launch-editor` package where `fs.existsSync()` can be bypassed on Windows using crafted paths ending in `\\\\..:line:column`, leading to OS command injection. Vite declares `launch-editor-middleware: ^2.14.1` as a dependency and exposes it at the `/__open-in-editor` endpoint. However, Vite's own source code does NOT contain the vulnerable pattern ..." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:15:20.802837+00:00", "status_notes": "Vulnerability CVE-2026-112943 is fixed in version 8.0.16-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-112943" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2026-112944 does not affect version 8.0.16-tuxcare.2 of vite. not_affected \u2014 Vite 8.0.16 is not affected by CVE-2026-112944 for the majority (non-WSL) of users. The target uses launch-editor-middleware 2.14.1, which includes the defense that converts file paths to absolute paths before passing to editors, preventing CLI flag interpretation. This fix was already present in the upstream Vite 8.0.16 release. Note: WSL users remain vulnerable as a known limitation documente...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112944" }, "impact_statement": "not_affected \u2014 Vite 8.0.16 is not affected by CVE-2026-112944 for the majority (non-WSL) of users. The target uses launch-editor-middleware 2.14.1, which includes the defense that converts file paths to absolute paths before passing to editors, preventing CLI flag interpretation. This fix was already present in the upstream Vite 8.0.16 release. Note: WSL users remain vulnerable as a known limitation documente..." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2026-112945 is fixed in version 8.0.16-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-112945" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:15:20.802837+00:00", "status_notes": "Vulnerability CVE-2026-112946 is fixed in version 8.0.16-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-112946" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2026-112947 does not affect version 8.0.16-tuxcare.2 of vite. not_affected \u2014 Version 8.0.16 is not affected by CVE-2026-112947. The vulnerability requires the `?vite-wasm-instance` query parameter handling feature (WASM ESM Integration), which was introduced in Vite v8.2.0 (commit 9e79b5157). Version 8.0.16 predates this feature and does not process `?vite-wasm-instance` requests. The wasm plugin in v8.0.16 only handles `.wasm?init` queries via `wasmInitRE`, and no othe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112947" }, "impact_statement": "not_affected \u2014 Version 8.0.16 is not affected by CVE-2026-112947. The vulnerability requires the `?vite-wasm-instance` query parameter handling feature (WASM ESM Integration), which was introduced in Vite v8.2.0 (commit 9e79b5157). Version 8.0.16 predates this feature and does not process `?vite-wasm-instance` requests. The wasm plugin in v8.0.16 only handles `.wasm?init` queries via `wasmInitRE`, and no othe..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2026-118662 does not affect version 8.0.16-tuxcare.2 of vite. not_affected \u2014 CVE-2026-118662 describes a vulnerability where files blocked by `server.fs.deny` could be accessed by appending query parameters like `?raw`, `?import&raw`, or `?import&url&inline`. The fix from PR #22160 (commit a9a3df299) is present in the target repository at version 8.0.16. This fix modifies the `isServerAccessDeniedForTransform` function to check access controls against BOTH the cleaned U...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-118662" }, "impact_statement": "not_affected \u2014 CVE-2026-118662 describes a vulnerability where files blocked by `server.fs.deny` could be accessed by appending query parameters like `?raw`, `?import&raw`, or `?import&url&inline`. The fix from PR #22160 (commit a9a3df299) is present in the target repository at version 8.0.16. This fix modifies the `isServerAccessDeniedForTransform` function to check access controls against BOTH the cleaned U..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2026-39363 affects version 8.0.16-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-39363" }, "action_statement": "Vulnerability CVE-2026-39363 affects version 8.0.16-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2026-39364 affects version 8.0.16-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-39364" }, "action_statement": "Vulnerability CVE-2026-39364 affects version 8.0.16-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2026-39365 does not affect version 8.0.16-tuxcare.2 of vite. not_affected \u2014 Vite 8.0.16 already contains the upstream fix for CVE-2026-39365 (79f002f22, \"avoid path traversal with optimize deps sourcemap handler\", #22161). The fix is in the upstream release that TuxCare onboarded, so it is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39365" }, "impact_statement": "not_affected \u2014 Vite 8.0.16 already contains the upstream fix for CVE-2026-39365 (79f002f22, \"avoid path traversal with optimize deps sourcemap handler\", #22161). The fix is in the upstream release that TuxCare onboarded, so it is not a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2026-53571 affects version 8.0.16-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-53571" }, "action_statement": "Vulnerability CVE-2026-53571 affects version 8.0.16-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.16-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.16-tuxcare.2" } } ], "timestamp": "2026-11-12T17:14:59.592218+00:00", "status_notes": "Vulnerability CVE-2026-53632 does not affect version 8.0.16-tuxcare.2 of vite. not_affected \u2014 CVE-2026-53632 concerns Windows UNC path handling in the launch-editor package, which could leak NTLM password hashes. The target repository (Vite 8.0.16) includes the upstream fix in commit 50b951225, which bumped launch-editor-middleware from 2.14.0 to 2.14.1. Version 2.14.1 includes UNC path rejection guards that prevent file system access to UNC paths before fs.existsSync() is called, there...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53632" }, "impact_statement": "not_affected \u2014 CVE-2026-53632 concerns Windows UNC path handling in the launch-editor package, which could leak NTLM password hashes. The target repository (Vite 8.0.16) includes the upstream fix in commit 50b951225, which bumped launch-editor-middleware from 2.14.0 to 2.14.1. Version 2.14.1 includes UNC path rejection guards that prevent file system access to UNC paths before fs.existsSync() is called, there..." } ] }