{ "@id": "urn:uuid:5a900129-fada-444e-8f47-5552ec3ae44e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 25, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T11:40:00.636701+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 8.0.9 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 8.0.9 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 8.0.9 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 8.0.9 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-49293 affects version 8.0.9 of vite.", "vulnerability": { "name": "CVE-2023-49293" }, "action_statement": "Vulnerability CVE-2023-49293 affects version 8.0.9 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-23331 affects version 8.0.9 of vite.", "vulnerability": { "name": "CVE-2024-23331" }, "action_statement": "Vulnerability CVE-2024-23331 affects version 8.0.9 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-03T23:46:09.023953+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 8.0.9 of vite. not_affected \u2014 CVE-2024-31207 affects Vite's server.fs.deny option which used picomatch with matchBase:true, causing glob patterns with directories to match only basenames instead of full paths, allowing bypass. The target (Vite 8.0.9-tuxcare.2) is NOT AFFECTED because the upstream fix shipped in the release. Commit 242f550eb (Environment API, Sep 2024) by patak@users.noreply.github.com moved fsDenyGlob to co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "not_affected \u2014 CVE-2024-31207 affects Vite's server.fs.deny option which used picomatch with matchBase:true, causing glob patterns with directories to match only basenames instead of full paths, allowing bypass. The target (Vite 8.0.9-tuxcare.2) is NOT AFFECTED because the upstream fix shipped in the release. Commit 242f550eb (Environment API, Sep 2024) by patak@users.noreply.github.com moved fsDenyGlob to co..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-03T23:52:00.070015+00:00", "status_notes": "Vulnerability CVE-2024-45811 does not affect version 8.0.9 of vite. not_affected \u2014 CVE-2024-45811 is not present in Vite 8.0.9-tuxcare.2. The upstream fix (commit 9d2413c8b, PR #18112) was already included in Vite 8.0.9 before TuxCare onboarded it. The fix prevents filesystem access bypass by validating URLs with ?raw or ?url query parameters against the serving allow list. The current codebase contains an evolved version of this fix through isServerAccessDeniedForTransform()...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45811" }, "impact_statement": "not_affected \u2014 CVE-2024-45811 is not present in Vite 8.0.9-tuxcare.2. The upstream fix (commit 9d2413c8b, PR #18112) was already included in Vite 8.0.9 before TuxCare onboarded it. The fix prevents filesystem access bypass by validating URLs with ?raw or ?url query parameters against the serving allow list. The current codebase contains an evolved version of this fix through isServerAccessDeniedForTransform()..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-45812 affects version 8.0.9 of vite.", "vulnerability": { "name": "CVE-2024-45812" }, "action_statement": "Vulnerability CVE-2024-45812 affects version 8.0.9 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-52011 affects version 8.0.9 of vite.", "vulnerability": { "name": "CVE-2024-52011" }, "action_statement": "Vulnerability CVE-2024-52011 affects version 8.0.9 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-03T23:56:16.973789+00:00", "status_notes": "Vulnerability CVE-2025-24010 does not affect version 8.0.9 of vite. not_affected \u2014 CVE-2025-24010 describes three vulnerabilities in Vite's development server: (1) permissive CORS allowing any origin, (2) lack of WebSocket origin validation enabling CSWSH attacks, and (3) lack of Host header validation enabling DNS rebinding. The target repository (Vite 8.0.9-tuxcare.2) contains all three upstream security fixes that were already present in the upstream Vite 8.0.9 release bef...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24010" }, "impact_statement": "not_affected \u2014 CVE-2025-24010 describes three vulnerabilities in Vite's development server: (1) permissive CORS allowing any origin, (2) lack of WebSocket origin validation enabling CSWSH attacks, and (3) lack of Host header validation enabling DNS rebinding. The target repository (Vite 8.0.9-tuxcare.2) contains all three upstream security fixes that were already present in the upstream Vite 8.0.9 release bef..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-06T11:28:00.026983+00:00", "status_notes": "Vulnerability CVE-2025-30208 does not affect version 8.0.9 of vite. not_affected \u2014 Vite 8.0.9-tuxcare.2 is not affected by CVE-2025-30208. The upstream fix for #19702 (main-branch commit 262b5ec7a) and the later fs-check refactor (59673137c) are both ancestors of HEAD and shipped in the upstream release TuxCare onboarded. The access-check regexes in transform.ts (`[?&]raw\\b`) match `?raw??` and `?import&raw??`. The access check therefore runs and denies out-of-allow-list files.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-30208" }, "impact_statement": "not_affected \u2014 Vite 8.0.9-tuxcare.2 is not affected by CVE-2025-30208. The upstream fix for #19702 (main-branch commit 262b5ec7a) and the later fs-check refactor (59673137c) are both ancestors of HEAD and shipped in the upstream release TuxCare onboarded. The access-check regexes in transform.ts (`[?&]raw\\b`) match `?raw??` and `?import&raw??`. The access check therefore runs and denies out-of-allow-list files." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-06T11:28:00.026983+00:00", "status_notes": "Vulnerability CVE-2025-31125 does not affect version 8.0.9 of vite. not_affected \u2014 Vite 8.0.9 already contains the upstream fix for CVE-2025-31125. The fix is upstream commit 59673137 (\"fix: fs check in transform middleware\", #19761, author patak-dev). It is an ancestor of the first TuxCare commit, so it shipped in the upstream release. The transform path applies the server.fs allow/deny check to ?raw, ?url and ?inline requests (including combined ?import forms) before the fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31125" }, "impact_statement": "not_affected \u2014 Vite 8.0.9 already contains the upstream fix for CVE-2025-31125. The fix is upstream commit 59673137 (\"fix: fs check in transform middleware\", #19761, author patak-dev). It is an ancestor of the first TuxCare commit, so it shipped in the upstream release. The transform path applies the server.fs allow/deny check to ?raw, ?url and ?inline requests (including combined ?import forms) before the fi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-06T11:33:00.046652+00:00", "status_notes": "Vulnerability CVE-2025-31486 does not affect version 8.0.9 of vite. not_affected \u2014 Target is Vite 8.0.9 (TuxCare tuxcare.2). The upstream fix for CVE-2025-31486 (vitejs/vite #19782, commit 62d7e81ee) is an ancestor of HEAD and predates the first TuxCare commit, so it shipped in the upstream release. The target applies the server.fs check to svg/raw/url/inline ids and to the resolved id in loadAndTransform, so the svg and relative-path bypasses do not work.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31486" }, "impact_statement": "not_affected \u2014 Target is Vite 8.0.9 (TuxCare tuxcare.2). The upstream fix for CVE-2025-31486 (vitejs/vite #19782, commit 62d7e81ee) is an ancestor of HEAD and predates the first TuxCare commit, so it shipped in the upstream release. The target applies the server.fs check to svg/raw/url/inline ids and to the resolved id in loadAndTransform, so the svg and relative-path bypasses do not work." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-06T11:37:00.035304+00:00", "status_notes": "Vulnerability CVE-2025-32395 does not affect version 8.0.9 of vite. not_affected \u2014 Vite 8.0.9 already contains the upstream fix for CVE-2025-32395. Commit 175a83909f (\"fix: reject requests with `#` in request-target\", author green@sapphi.red) is in HEAD and shipped in the upstream release. It adds rejectInvalidRequestMiddleware, which returns 400 for any req.url containing '#'. The middleware is registered ahead of all file-serving middlewares. No TuxCare commit carries this ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32395" }, "impact_statement": "not_affected \u2014 Vite 8.0.9 already contains the upstream fix for CVE-2025-32395. Commit 175a83909f (\"fix: reject requests with `#` in request-target\", author green@sapphi.red) is in HEAD and shipped in the upstream release. It adds rejectInvalidRequestMiddleware, which returns 400 for any req.url containing '#'. The middleware is registered ahead of all file-serving middlewares. No TuxCare commit carries this ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-03T23:57:41.357195+00:00", "status_notes": "Vulnerability CVE-2025-46565 does not affect version 8.0.9 of vite. not_affected \u2014 CVE-2025-46565 fix is already present in target Vite 8.0.9. The vulnerability allowed bypassing server.fs.deny patterns via `/.` path combinations (e.g., `/.env/.`) to read sensitive files. The upstream fix (commit c22c43de6) was shipped in the Vite 8.0.9 release before TuxCare onboarding. The fix adds a `shouldServe` callback to sirv that checks file access via `checkLoadingAccess()` before se...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46565" }, "impact_statement": "not_affected \u2014 CVE-2025-46565 fix is already present in target Vite 8.0.9. The vulnerability allowed bypassing server.fs.deny patterns via `/.` path combinations (e.g., `/.env/.`) to read sensitive files. The upstream fix (commit c22c43de6) was shipped in the Vite 8.0.9 release before TuxCare onboarding. The fix adds a `shouldServe` callback to sirv that checks file access via `checkLoadingAccess()` before se..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-04T00:13:28.256702+00:00", "status_notes": "Vulnerability CVE-2025-58751 does not affect version 8.0.9 of vite. not_affected \u2014 CVE-2025-58751 describes a path traversal vulnerability where files outside the public directory can be accessed when symlinks are present. The vulnerability relies on two conditions: (1) publicFiles becomes undefined when symlinks exist, causing all requests to bypass pre-checks and pass directly to sirv; (2) sirv's startsWith boundary check can be bypassed if the directory path lacks a traili...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58751" }, "impact_statement": "not_affected \u2014 CVE-2025-58751 describes a path traversal vulnerability where files outside the public directory can be accessed when symlinks are present. The vulnerability relies on two conditions: (1) publicFiles becomes undefined when symlinks exist, causing all requests to bypass pre-checks and pass directly to sirv; (2) sirv's startsWith boundary check can be bypassed if the directory path lacks a traili..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-04T00:16:00.125872+00:00", "status_notes": "Vulnerability CVE-2025-58752 does not affect version 8.0.9 of vite. not_affected \u2014 The target repository (Vite 8.0.9-tuxcare.2) is NOT affected by CVE-2025-58752. The vulnerability allows arbitrary HTML file access bypassing server.fs access controls, but the fix was already present in the upstream Vite v8.0.9 release. The security patch (commit 14015d794) that adds checkLoadingAccess validation to indexHtml.ts was authored by upstream developer green@sapphi.red and was inclu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58752" }, "impact_statement": "not_affected \u2014 The target repository (Vite 8.0.9-tuxcare.2) is NOT affected by CVE-2025-58752. The vulnerability allows arbitrary HTML file access bypassing server.fs access controls, but the fix was already present in the upstream Vite v8.0.9 release. The security patch (commit 14015d794) that adds checkLoadingAccess validation to indexHtml.ts was authored by upstream developer green@sapphi.red and was inclu..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-04T00:19:00.085681+00:00", "status_notes": "Vulnerability CVE-2025-62522 does not affect version 8.0.9 of vite. not_affected \u2014 The target is not affected by CVE-2025-62522. The upstream fix (commit f479cc57c by green@sapphi.red, 2025-10-20) was already present in the upstream v8.0.9 release that TuxCare onboarded. The fix strips trailing slashes from file paths before checking against server.fs.deny glob patterns, preventing bypass via URLs ending with backslash or forward slash. The slash() function normalizes all bac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62522" }, "impact_statement": "not_affected \u2014 The target is not affected by CVE-2025-62522. The upstream fix (commit f479cc57c by green@sapphi.red, 2025-10-20) was already present in the upstream v8.0.9 release that TuxCare onboarded. The fix strips trailing slashes from file paths before checking against server.fs.deny glob patterns, preventing bypass via URLs ending with backslash or forward slash. The slash() function normalizes all bac..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-10-20T19:57:00.094462+00:00", "status_notes": "Vulnerability CVE-2026-112942 affects version 8.0.9 of vite.", "vulnerability": { "name": "CVE-2026-112942" }, "action_statement": "Vulnerability CVE-2026-112942 affects version 8.0.9 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-10-20T18:59:00.099754+00:00", "status_notes": "Vulnerability CVE-2026-112943 does not affect version 8.0.9 of vite. not_affected \u2014 CVE-2026-112943 affects the `launch-editor` package's handling of filenames containing `%` characters on Windows, where environment variable expansion can lead to command injection. The Vite repository (version 8.0.9-tuxcare.1) does not contain the vulnerable code. Vite uses `launch-editor-middleware@2.14.1` as a declared devDependency, which internally depends on `launch-editor@2.14.1`. The vu...", "vulnerability": { "name": "CVE-2026-112943" }, "impact_statement": "not_affected \u2014 CVE-2026-112943 affects the `launch-editor` package's handling of filenames containing `%` characters on Windows, where environment variable expansion can lead to command injection. The Vite repository (version 8.0.9-tuxcare.1) does not contain the vulnerable code. Vite uses `launch-editor-middleware@2.14.1` as a declared devDependency, which internally depends on `launch-editor@2.14.1`. The vu..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-10-20T19:57:00.094462+00:00", "status_notes": "Vulnerability CVE-2026-112944 affects version 8.0.9 of vite.", "vulnerability": { "name": "CVE-2026-112944" }, "action_statement": "Vulnerability CVE-2026-112944 affects version 8.0.9 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-10-27T11:15:25.270220+00:00", "status_notes": "Vulnerability CVE-2026-112945 affects version 8.0.9 of vite, and is fixed in 8.0.9-tuxcare.2.", "vulnerability": { "name": "CVE-2026-112945" }, "action_statement": "Vulnerability CVE-2026-112945 affects version 8.0.9 of vite, and is fixed in 8.0.9-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-10-27T11:15:25.270220+00:00", "status_notes": "Vulnerability CVE-2026-112946 affects version 8.0.9 of vite, and is fixed in 8.0.9-tuxcare.2.", "vulnerability": { "name": "CVE-2026-112946" }, "action_statement": "Vulnerability CVE-2026-112946 affects version 8.0.9 of vite, and is fixed in 8.0.9-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-04T02:54:41.160467+00:00", "status_notes": "Vulnerability CVE-2026-112947 does not affect version 8.0.9 of vite. not_affected \u2014 Version 8.0.9 is not affected by CVE-2026-112947. The vulnerability requires the `?vite-wasm-instance` query parameter handling feature, which was introduced in commit 9e79b5157 on 2026-07-16, almost three months after v8.0.9 was released (2026-04-20). The target version does not contain the code that processes this query parameter, nor does it have the direct WASM imports feature that uses it....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112947" }, "impact_statement": "not_affected \u2014 Version 8.0.9 is not affected by CVE-2026-112947. The vulnerability requires the `?vite-wasm-instance` query parameter handling feature, which was introduced in commit 9e79b5157 on 2026-07-16, almost three months after v8.0.9 was released (2026-04-20). The target version does not contain the code that processes this query parameter, nor does it have the direct WASM imports feature that uses it...." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-03T20:48:00.093952+00:00", "status_notes": "Vulnerability CVE-2026-118662 does not affect version 8.0.9 of vite. not_affected \u2014 CVE-2026-118662 (GHSA-v2wj-q39q-566r) describes a server.fs.deny bypass vulnerability where files blocked by server.fs.deny can be accessed by appending query parameters (?raw, ?import&raw, ?import&url&inline). The target repository (Vite 8.0.9-tuxcare.2) is NOT AFFECTED because the upstream fix (PR #22160) was already shipped in Vite 8.0.9 release. The fix modifies isServerAccessDeniedForTrans...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-118662" }, "impact_statement": "not_affected \u2014 CVE-2026-118662 (GHSA-v2wj-q39q-566r) describes a server.fs.deny bypass vulnerability where files blocked by server.fs.deny can be accessed by appending query parameters (?raw, ?import&raw, ?import&url&inline). The target repository (Vite 8.0.9-tuxcare.2) is NOT AFFECTED because the upstream fix (PR #22160) was already shipped in Vite 8.0.9 release. The fix modifies isServerAccessDeniedForTrans..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-10-30T14:47:00.151806+00:00", "status_notes": "Vulnerability CVE-2026-39363 affects version 8.0.9 of vite.", "vulnerability": { "name": "CVE-2026-39363" }, "action_statement": "Vulnerability CVE-2026-39363 affects version 8.0.9 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-10-30T14:47:00.151806+00:00", "status_notes": "Vulnerability CVE-2026-39364 affects version 8.0.9 of vite.", "vulnerability": { "name": "CVE-2026-39364" }, "action_statement": "Vulnerability CVE-2026-39364 affects version 8.0.9 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-11-06T11:40:00.636701+00:00", "status_notes": "Vulnerability CVE-2026-39365 does not affect version 8.0.9 of vite. not_affected \u2014 Not affected. The upstream fix for CVE-2026-39365 (vitejs/vite 79f002f2, \"avoid path traversal with optimize deps sourcemap handler\") is already in the target tree. It shipped in the upstream release that TuxCare onboarded, so this is an upstream fix and not a TuxCare backport. The optimized-deps .map handler resolves the requested path and rejects it unless it lies under the optimizer cache dir.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39365" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2026-39365 (vitejs/vite 79f002f2, \"avoid path traversal with optimize deps sourcemap handler\") is already in the target tree. It shipped in the upstream release that TuxCare onboarded, so this is an upstream fix and not a TuxCare backport. The optimized-deps .map handler resolves the requested path and rejects it unless it lies under the optimizer cache dir." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-10-20T09:18:00.121613+00:00", "status_notes": "Vulnerability CVE-2026-53571 affects version 8.0.9 of vite, and is fixed in 8.0.9-tuxcare.1.", "vulnerability": { "name": "CVE-2026-53571" }, "action_statement": "Vulnerability CVE-2026-53571 affects version 8.0.9 of vite, and is fixed in 8.0.9-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.9", "identifiers": { "purl": "pkg:npm/vite@8.0.9" } } ], "timestamp": "2026-10-20T09:18:00.121613+00:00", "status_notes": "Vulnerability CVE-2026-53632 affects version 8.0.9 of vite, and is fixed in 8.0.9-tuxcare.1.", "vulnerability": { "name": "CVE-2026-53632" }, "action_statement": "Vulnerability CVE-2026-53632 affects version 8.0.9 of vite, and is fixed in 8.0.9-tuxcare.1." } ] }