Vite vulnerabilities and security advisories

The newest reviewed advisories for vite on npm. Each one shows which versions are affected, which version fixes it, and a prompt that has your AI agent check your project and upgrade only if it needs to.

Get an email when Vite has a new one

Email alerts are coming soon. This page updates every hour.

$ latest 22 · 8 critical, high or exploited

mediumJun 15, 2026

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

vite >= 8.0.0, <= 8.0.15 · fixed in 8.0.16
vite >= 7.0.0, <= 7.3.4 · fixed in 7.3.5
vite <= 6.4.2 · fixed in 6.4.3

GHSA-v6wh-96g9-6wx3CVE-2026-53632

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-v6wh-96g9-6wx3 (CVE-2026-53632), severity medium
What it is: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
Affected packages:
- vite: affected versions >= 8.0.0, <= 8.0.15. Fixed in 8.0.16.
- vite: affected versions >= 7.0.0, <= 7.3.4. Fixed in 7.3.5.
- vite: affected versions <= 6.4.2. Fixed in 6.4.3.
Details: https://github.com/advisories/GHSA-v6wh-96g9-6wx3

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highJun 15, 2026

vite: `server.fs.deny` bypass on Windows alternate paths

vite >= 8.0.0, <= 8.0.15 · fixed in 8.0.16
vite >= 7.0.0, <= 7.3.4 · fixed in 7.3.5
vite <= 6.4.2 · fixed in 6.4.3

GHSA-fx2h-pf6j-xcffCVE-2026-53571

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-fx2h-pf6j-xcff (CVE-2026-53571), severity high
What it is: vite: `server.fs.deny` bypass on Windows alternate paths
Affected packages:
- vite: affected versions >= 8.0.0, <= 8.0.15. Fixed in 8.0.16.
- vite: affected versions >= 7.0.0, <= 7.3.4. Fixed in 7.3.5.
- vite: affected versions <= 6.4.2. Fixed in 6.4.3.
Details: https://github.com/advisories/GHSA-fx2h-pf6j-xcff

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highJun 3, 2026

launch-editor vulnerable to command injection via the crafted request on Windows

vite <= 5.4.8 · fixed in 5.4.9

GHSA-c27g-q93r-2cwfCVE-2024-52011

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-c27g-q93r-2cwf (CVE-2024-52011), severity high
What it is: launch-editor vulnerable to command injection via the crafted request on Windows
Affected packages:
- vite: affected versions <= 5.4.8. Fixed in 5.4.9.
Details: https://github.com/advisories/GHSA-c27g-q93r-2cwf

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumApr 6, 2026

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

vite >= 8.0.0, <= 8.0.4 · fixed in 8.0.5
vite >= 7.0.0, <= 7.3.1 · fixed in 7.3.2
vite <= 6.4.1 · fixed in 6.4.2

GHSA-4w7w-66w2-5vf9CVE-2026-39365

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-4w7w-66w2-5vf9 (CVE-2026-39365), severity medium
What it is: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling
Affected packages:
- vite: affected versions >= 8.0.0, <= 8.0.4. Fixed in 8.0.5.
- vite: affected versions >= 7.0.0, <= 7.3.1. Fixed in 7.3.2.
- vite: affected versions <= 6.4.1. Fixed in 6.4.2.
Details: https://github.com/advisories/GHSA-4w7w-66w2-5vf9

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highApr 6, 2026

Vite: `server.fs.deny` bypassed with queries

vite >= 8.0.0, <= 8.0.4 · fixed in 8.0.5
vite >= 7.1.0, <= 7.3.1 · fixed in 7.3.2

GHSA-v2wj-q39q-566rCVE-2026-39364

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-v2wj-q39q-566r (CVE-2026-39364), severity high
What it is: Vite: `server.fs.deny` bypassed with queries
Affected packages:
- vite: affected versions >= 8.0.0, <= 8.0.4. Fixed in 8.0.5.
- vite: affected versions >= 7.1.0, <= 7.3.1. Fixed in 7.3.2.
Details: https://github.com/advisories/GHSA-v2wj-q39q-566r

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highApr 6, 2026

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

vite >= 8.0.0, <= 8.0.4 · fixed in 8.0.5
vite >= 7.0.0, <= 7.3.1 · fixed in 7.3.2
vite >= 6.0.0, <= 6.4.1 · fixed in 6.4.2

GHSA-p9ff-h696-f583CVE-2026-39363

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-p9ff-h696-f583 (CVE-2026-39363), severity high
What it is: Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
Affected packages:
- vite: affected versions >= 8.0.0, <= 8.0.4. Fixed in 8.0.5.
- vite: affected versions >= 7.0.0, <= 7.3.1. Fixed in 7.3.2.
- vite: affected versions >= 6.0.0, <= 6.4.1. Fixed in 6.4.2.
Details: https://github.com/advisories/GHSA-p9ff-h696-f583

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumOct 20, 2025

vite allows server.fs.deny bypass via backslash on Windows

vite >= 7.1.0, <= 7.1.10 · fixed in 7.1.11
vite >= 7.0.0, <= 7.0.7 · fixed in 7.0.8
vite >= 6.0.0, <= 6.4.0 · fixed in 6.4.1
vite >= 2.9.18, < 3.0.0 · fixed in 5.4.21
vite >= 3.2.9, < 4.0.0 · fixed in 5.4.21
vite >= 4.5.3, < 5.0.0 · fixed in 5.4.21
vite >= 5.2.6, <= 5.4.20 · fixed in 5.4.21

GHSA-93m4-6634-74q7CVE-2025-62522

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-93m4-6634-74q7 (CVE-2025-62522), severity medium
What it is: vite allows server.fs.deny bypass via backslash on Windows
Affected packages:
- vite: affected versions >= 7.1.0, <= 7.1.10. Fixed in 7.1.11.
- vite: affected versions >= 7.0.0, <= 7.0.7. Fixed in 7.0.8.
- vite: affected versions >= 6.0.0, <= 6.4.0. Fixed in 6.4.1.
- vite: affected versions >= 2.9.18, < 3.0.0. Fixed in 5.4.21.
- vite: affected versions >= 3.2.9, < 4.0.0. Fixed in 5.4.21.
- vite: affected versions >= 4.5.3, < 5.0.0. Fixed in 5.4.21.
- vite: affected versions >= 5.2.6, <= 5.4.20. Fixed in 5.4.21.
Details: https://github.com/advisories/GHSA-93m4-6634-74q7

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

lowSep 9, 2025

Vite middleware may serve files starting with the same name with the public directory

vite >= 7.1.0, <= 7.1.4 · fixed in 7.1.5
vite >= 7.0.0, <= 7.0.6 · fixed in 7.0.7
vite >= 6.0.0, <= 6.3.5 · fixed in 6.3.6
vite <= 5.4.19 · fixed in 5.4.20

GHSA-g4jq-h2w9-997cCVE-2025-58751

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-g4jq-h2w9-997c (CVE-2025-58751), severity low
What it is: Vite middleware may serve files starting with the same name with the public directory
Affected packages:
- vite: affected versions >= 7.1.0, <= 7.1.4. Fixed in 7.1.5.
- vite: affected versions >= 7.0.0, <= 7.0.6. Fixed in 7.0.7.
- vite: affected versions >= 6.0.0, <= 6.3.5. Fixed in 6.3.6.
- vite: affected versions <= 5.4.19. Fixed in 5.4.20.
Details: https://github.com/advisories/GHSA-g4jq-h2w9-997c

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

lowSep 9, 2025

Vite's `server.fs` settings were not applied to HTML files

vite >= 7.1.0, <= 7.1.4 · fixed in 7.1.5
vite >= 7.0.0, <= 7.0.6 · fixed in 7.0.7
vite >= 6.0.0, <= 6.3.5 · fixed in 6.3.6
vite <= 5.4.19 · fixed in 5.4.20

GHSA-jqfw-vq24-v9c3CVE-2025-58752

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-jqfw-vq24-v9c3 (CVE-2025-58752), severity low
What it is: Vite's `server.fs` settings were not applied to HTML files
Affected packages:
- vite: affected versions >= 7.1.0, <= 7.1.4. Fixed in 7.1.5.
- vite: affected versions >= 7.0.0, <= 7.0.6. Fixed in 7.0.7.
- vite: affected versions >= 6.0.0, <= 6.3.5. Fixed in 6.3.6.
- vite: affected versions <= 5.4.19. Fixed in 5.4.20.
Details: https://github.com/advisories/GHSA-jqfw-vq24-v9c3

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumApr 30, 2025

Vite's server.fs.deny bypassed with /. for files under project root

vite >= 6.3.0, <= 6.3.3 · fixed in 6.3.4
vite >= 6.2.0, <= 6.2.6 · fixed in 6.2.7
vite >= 6.0.0, <= 6.1.5 · fixed in 6.1.6
vite >= 5.0.0, <= 5.4.18 · fixed in 5.4.19
vite <= 4.5.13 · fixed in 4.5.14

GHSA-859w-5945-r5v3CVE-2025-46565

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-859w-5945-r5v3 (CVE-2025-46565), severity medium
What it is: Vite's server.fs.deny bypassed with /. for files under project root
Affected packages:
- vite: affected versions >= 6.3.0, <= 6.3.3. Fixed in 6.3.4.
- vite: affected versions >= 6.2.0, <= 6.2.6. Fixed in 6.2.7.
- vite: affected versions >= 6.0.0, <= 6.1.5. Fixed in 6.1.6.
- vite: affected versions >= 5.0.0, <= 5.4.18. Fixed in 5.4.19.
- vite: affected versions <= 4.5.13. Fixed in 4.5.14.
Details: https://github.com/advisories/GHSA-859w-5945-r5v3

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumApr 11, 2025

Vite has an `server.fs.deny` bypass with an invalid `request-target`

vite >= 6.2.0, < 6.2.6 · fixed in 6.2.6
vite >= 6.1.0, < 6.1.5 · fixed in 6.1.5
vite >= 6.0.0, < 6.0.15 · fixed in 6.0.15
vite >= 5.0.0, < 5.4.18 · fixed in 5.4.18
vite < 4.5.13 · fixed in 4.5.13

GHSA-356w-63v5-8wf4CVE-2025-32395

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-356w-63v5-8wf4 (CVE-2025-32395), severity medium
What it is: Vite has an `server.fs.deny` bypass with an invalid `request-target`
Affected packages:
- vite: affected versions >= 6.2.0, < 6.2.6. Fixed in 6.2.6.
- vite: affected versions >= 6.1.0, < 6.1.5. Fixed in 6.1.5.
- vite: affected versions >= 6.0.0, < 6.0.15. Fixed in 6.0.15.
- vite: affected versions >= 5.0.0, < 5.4.18. Fixed in 5.4.18.
- vite: affected versions < 4.5.13. Fixed in 4.5.13.
Details: https://github.com/advisories/GHSA-356w-63v5-8wf4

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumApr 4, 2025

Vite allows server.fs.deny to be bypassed with .svg or relative paths

vite >= 6.2.0, < 6.2.5 · fixed in 6.2.5
vite >= 6.1.0, < 6.1.4 · fixed in 6.1.4
vite >= 6.0.0, < 6.0.14 · fixed in 6.0.14
vite >= 5.0.0, < 5.4.17 · fixed in 5.4.17
vite < 4.5.12 · fixed in 4.5.12

GHSA-xcj6-pq6g-qj4xCVE-2025-31486

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-xcj6-pq6g-qj4x (CVE-2025-31486), severity medium
What it is: Vite allows server.fs.deny to be bypassed with .svg or relative paths
Affected packages:
- vite: affected versions >= 6.2.0, < 6.2.5. Fixed in 6.2.5.
- vite: affected versions >= 6.1.0, < 6.1.4. Fixed in 6.1.4.
- vite: affected versions >= 6.0.0, < 6.0.14. Fixed in 6.0.14.
- vite: affected versions >= 5.0.0, < 5.4.17. Fixed in 5.4.17.
- vite: affected versions < 4.5.12. Fixed in 4.5.12.
Details: https://github.com/advisories/GHSA-xcj6-pq6g-qj4x

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumexploited in the wildMar 31, 2025

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

vite >= 6.2.0, < 6.2.4 · fixed in 6.2.4
vite >= 6.1.0, < 6.1.3 · fixed in 6.1.3
vite >= 6.0.0, < 6.0.13 · fixed in 6.0.13
vite >= 5.0.0, < 5.4.16 · fixed in 5.4.16
vite < 4.5.11 · fixed in 4.5.11

GHSA-4r4m-qw57-chr8CVE-2025-31125

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-4r4m-qw57-chr8 (CVE-2025-31125), severity medium
What it is: Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
CISA lists this as exploited in the wild, so treat it as urgent.
Affected packages:
- vite: affected versions >= 6.2.0, < 6.2.4. Fixed in 6.2.4.
- vite: affected versions >= 6.1.0, < 6.1.3. Fixed in 6.1.3.
- vite: affected versions >= 6.0.0, < 6.0.13. Fixed in 6.0.13.
- vite: affected versions >= 5.0.0, < 5.4.16. Fixed in 5.4.16.
- vite: affected versions < 4.5.11. Fixed in 4.5.11.
Details: https://github.com/advisories/GHSA-4r4m-qw57-chr8

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumMar 25, 2025

Vite bypasses server.fs.deny when using ?raw??

vite >= 6.2.0, < 6.2.3 · fixed in 6.2.3
vite >= 6.1.0, < 6.1.2 · fixed in 6.1.2
vite >= 6.0.0, < 6.0.12 · fixed in 6.0.12
vite >= 5.0.0, < 5.4.15 · fixed in 5.4.15
vite < 4.5.10 · fixed in 4.5.10

GHSA-x574-m823-4x7wCVE-2025-30208

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-x574-m823-4x7w (CVE-2025-30208), severity medium
What it is: Vite bypasses server.fs.deny when using ?raw??
Affected packages:
- vite: affected versions >= 6.2.0, < 6.2.3. Fixed in 6.2.3.
- vite: affected versions >= 6.1.0, < 6.1.2. Fixed in 6.1.2.
- vite: affected versions >= 6.0.0, < 6.0.12. Fixed in 6.0.12.
- vite: affected versions >= 5.0.0, < 5.4.15. Fixed in 5.4.15.
- vite: affected versions < 4.5.10. Fixed in 4.5.10.
Details: https://github.com/advisories/GHSA-x574-m823-4x7w

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumJan 21, 2025

Websites were able to send any requests to the development server and read the response in vite

vite >= 6.0.0, <= 6.0.8 · fixed in 6.0.9
vite >= 5.0.0, <= 5.4.11 · fixed in 5.4.12
vite <= 4.5.5 · fixed in 4.5.6

GHSA-vg6x-rcgg-rjx6CVE-2025-24010

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-vg6x-rcgg-rjx6 (CVE-2025-24010), severity medium
What it is: Websites were able to send any requests to the development server and read the response in vite
Affected packages:
- vite: affected versions >= 6.0.0, <= 6.0.8. Fixed in 6.0.9.
- vite: affected versions >= 5.0.0, <= 5.4.11. Fixed in 5.4.12.
- vite: affected versions <= 4.5.5. Fixed in 4.5.6.
Details: https://github.com/advisories/GHSA-vg6x-rcgg-rjx6

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumSep 17, 2024

Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS

vite >= 4.0.0, < 4.5.4 · fixed in 4.5.4
vite >= 5.4.0, < 5.4.6 · fixed in 5.4.6
vite >= 5.3.0, < 5.3.6 · fixed in 5.3.6
vite >= 5.2.0, < 5.2.14 · fixed in 5.2.14
vite < 3.2.11 · fixed in 3.2.11
vite >= 5.0.0, < 5.1.8 · fixed in 5.1.8

GHSA-64vr-g452-qvp3CVE-2024-45812

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-64vr-g452-qvp3 (CVE-2024-45812), severity medium
What it is: Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
Affected packages:
- vite: affected versions >= 4.0.0, < 4.5.4. Fixed in 4.5.4.
- vite: affected versions >= 5.4.0, < 5.4.6. Fixed in 5.4.6.
- vite: affected versions >= 5.3.0, < 5.3.6. Fixed in 5.3.6.
- vite: affected versions >= 5.2.0, < 5.2.14. Fixed in 5.2.14.
- vite: affected versions < 3.2.11. Fixed in 3.2.11.
- vite: affected versions >= 5.0.0, < 5.1.8. Fixed in 5.1.8.
Details: https://github.com/advisories/GHSA-64vr-g452-qvp3

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumSep 17, 2024

Vite's `server.fs.deny` is bypassed when using `?import&raw`

vite >= 5.4.0, <= 5.4.5 · fixed in 5.4.6
vite >= 5.3.0, <= 5.3.5 · fixed in 5.3.6
vite >= 4.0.0, <= 4.5.3 · fixed in 4.5.4
vite <= 3.2.10 · fixed in 3.2.11
vite >= 5.2.0, < 5.2.14 · fixed in 5.2.14
vite >= 5.0.0, <= 5.1.7 · fixed in 5.1.8

GHSA-9cwx-2883-4wfxCVE-2024-45811

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-9cwx-2883-4wfx (CVE-2024-45811), severity medium
What it is: Vite's `server.fs.deny` is bypassed when using `?import&raw`
Affected packages:
- vite: affected versions >= 5.4.0, <= 5.4.5. Fixed in 5.4.6.
- vite: affected versions >= 5.3.0, <= 5.3.5. Fixed in 5.3.6.
- vite: affected versions >= 4.0.0, <= 4.5.3. Fixed in 4.5.4.
- vite: affected versions <= 3.2.10. Fixed in 3.2.11.
- vite: affected versions >= 5.2.0, < 5.2.14. Fixed in 5.2.14.
- vite: affected versions >= 5.0.0, <= 5.1.7. Fixed in 5.1.8.
Details: https://github.com/advisories/GHSA-9cwx-2883-4wfx

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumApr 3, 2024

Vite's `server.fs.deny` did not deny requests for patterns with directories.

vite >= 2.7.0, <= 2.9.17 · fixed in 2.9.18
vite >= 3.0.0, <= 3.2.8 · fixed in 3.2.10
vite >= 4.0.0, <= 4.5.2 · fixed in 4.5.3
vite >= 5.0.0, <= 5.0.12 · fixed in 5.0.13
vite >= 5.1.0, <= 5.1.6 · fixed in 5.1.7
vite >= 5.2.0, <= 5.2.5 · fixed in 5.2.6

GHSA-8jhw-289h-jh2gCVE-2024-31207

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-8jhw-289h-jh2g (CVE-2024-31207), severity medium
What it is: Vite's `server.fs.deny` did not deny requests for patterns with directories.
Affected packages:
- vite: affected versions >= 2.7.0, <= 2.9.17. Fixed in 2.9.18.
- vite: affected versions >= 3.0.0, <= 3.2.8. Fixed in 3.2.10.
- vite: affected versions >= 4.0.0, <= 4.5.2. Fixed in 4.5.3.
- vite: affected versions >= 5.0.0, <= 5.0.12. Fixed in 5.0.13.
- vite: affected versions >= 5.1.0, <= 5.1.6. Fixed in 5.1.7.
- vite: affected versions >= 5.2.0, <= 5.2.5. Fixed in 5.2.6.
Details: https://github.com/advisories/GHSA-8jhw-289h-jh2g

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highJan 19, 2024

Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

vite >= 2.7.0, <= 2.9.16 · fixed in 2.9.17
vite >= 3.0.0, <= 3.2.7 · fixed in 3.2.8
vite >= 4.0.0, <= 4.5.1 · fixed in 4.5.2
vite >= 5.0.0, <= 5.0.11 · fixed in 5.0.12

GHSA-c24v-8rfc-w8vwCVE-2024-23331

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-c24v-8rfc-w8vw (CVE-2024-23331), severity high
What it is: Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Affected packages:
- vite: affected versions >= 2.7.0, <= 2.9.16. Fixed in 2.9.17.
- vite: affected versions >= 3.0.0, <= 3.2.7. Fixed in 3.2.8.
- vite: affected versions >= 4.0.0, <= 4.5.1. Fixed in 4.5.2.
- vite: affected versions >= 5.0.0, <= 5.0.11. Fixed in 5.0.12.
Details: https://github.com/advisories/GHSA-c24v-8rfc-w8vw

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

mediumDec 5, 2023

Vite XSS vulnerability in `server.transformIndexHtml` via URL payload

vite >= 4.4.0, < 4.4.12 · fixed in 4.4.12
vite = 4.5.0 · fixed in 4.5.1
vite >= 5.0.0, < 5.0.5 · fixed in 5.0.5

GHSA-92r3-m2mg-pj97CVE-2023-49293

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-92r3-m2mg-pj97 (CVE-2023-49293), severity medium
What it is: Vite XSS vulnerability in `server.transformIndexHtml` via URL payload
Affected packages:
- vite: affected versions >= 4.4.0, < 4.4.12. Fixed in 4.4.12.
- vite: affected versions = 4.5.0. Fixed in 4.5.1.
- vite: affected versions >= 5.0.0, < 5.0.5. Fixed in 5.0.5.
Details: https://github.com/advisories/GHSA-92r3-m2mg-pj97

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highJun 6, 2023

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

vite < 2.9.16 · fixed in 2.9.16
vite >= 3.0.2, < 3.2.7 · fixed in 3.2.7
vite >= 4.0.0, < 4.0.5 · fixed in 4.0.5
vite >= 4.1.0, < 4.1.5 · fixed in 4.1.5
vite >= 4.2.0, < 4.2.3 · fixed in 4.2.3
vite >= 4.3.0, < 4.3.9 · fixed in 4.3.9

GHSA-353f-5xf4-qw67CVE-2023-34092

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-353f-5xf4-qw67 (CVE-2023-34092), severity high
What it is: Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Affected packages:
- vite: affected versions < 2.9.16. Fixed in 2.9.16.
- vite: affected versions >= 3.0.2, < 3.2.7. Fixed in 3.2.7.
- vite: affected versions >= 4.0.0, < 4.0.5. Fixed in 4.0.5.
- vite: affected versions >= 4.1.0, < 4.1.5. Fixed in 4.1.5.
- vite: affected versions >= 4.2.0, < 4.2.3. Fixed in 4.2.3.
- vite: affected versions >= 4.3.0, < 4.3.9. Fixed in 4.3.9.
Details: https://github.com/advisories/GHSA-353f-5xf4-qw67

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

highAug 19, 2022

Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service

vite < 2.9.13 · fixed in 2.9.13
vite >= 3.0.0-alpha.0, < 3.0.0-beta.4 · fixed in 3.0.0-beta.4

GHSA-mv48-hcvh-8jj8CVE-2022-35204

prompt for your AI agent

paste into your agent

A security advisory covers a package this project may use.

Advisory: GHSA-mv48-hcvh-8jj8 (CVE-2022-35204), severity high
What it is: Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service
Affected packages:
- vite: affected versions < 2.9.13. Fixed in 2.9.13.
- vite: affected versions >= 3.0.0-alpha.0, < 3.0.0-beta.4. Fixed in 3.0.0-beta.4.
Details: https://github.com/advisories/GHSA-mv48-hcvh-8jj8

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

From the GitHub Advisory Database, refreshed hourly. Full history on GitHub.

Keeping Vite patched

npm audit (or pnpm audit) lists known vulnerable packages in your lockfile, including ones pulled in by other packages.
Turn on Dependabot for your GitHub repo and it opens the upgrade for you when an advisory lands.
A patched framework doesn't cover your own setup: headers, cookies and HTTPS. The free check looks at those.