npm: Vite: Cross origin script execution through Vite custom middleware

npm: Vite: Cross origin script execution through Vite custom middleware vulnerability discovered by ? in WordPress npm vite-plus versions = 1.0.0...

npm: Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

npm: Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machine vulnerability discovered by ? in WordPress npm vite-plus versions = 1.0.0...

Arbitrary Argument Injection

Overview vite-plus is a The Unified Toolchain for the Web Affected versions of this package are vulnerable to Arbitrary Argument Injection via the getArgumentsForFile function in packages/launch-editor/get-args.js, where a filename is passed directly to an editor process without being resolved to...

npm: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

npm: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors vulnerability discovered by ? in WordPress npm vite-plus versions = 1.0.0...

npm: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

npm: launch-editor: fs.existsSync existence check can be bypassed on Windows vulnerability discovered by ? in WordPress npm vite-plus versions = 1.0.0...

Command Injection

Overview vite-plus is a The Unified Toolchain for the Web Affected versions of this package are vulnerable to Command Injection via constructWindowsLaunchCommand in packages/launch-editor/construct-windows-launch-command.js, where file path arguments containing % characters are passed unsanitized...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) +1 more potentially affected by CVE-2026-53633 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =3.15.0-alpha.1776572752298, =3.19.3 Source cves: CVE-2026-53633 Source advisory: MEND:CVE-2026-53633...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) +1 more potentially affected by CVE-2026-53571 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =3.15.0-alpha.1776572752298, =3.19.3 Source cves: CVE-2026-53571 Source advisory: MEND:CVE-2026-53571...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) +1 more potentially affected by CVE-2026-53632 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =3.15.0-alpha.1776572752298, =3.19.3 Source cves: CVE-2026-53632 Source advisory: MEND:CVE-2026-53632...

NPM: Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

NPM: Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE vulnerability discovered by ? in WordPress Npm vite-plus versions = 0.1.23...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) +1 more potentially affected by CVE-2026-53633 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =3.15.0-alpha.1776572752298, =3.19.3 Source cves: CVE-2026-53633 Source advisory: GHSA-G8MR-85JM-7XHM...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) +1 more potentially affected by CVE-2026-53633 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =3.15.0-alpha.1776572752298, =3.19.3 Source cves: CVE-2026-53633 Source advisory: OSV:GHSA-G8MR-85JM-7XHM...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) +1 more potentially affected by CVE-2026-53632 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =3.15.0-alpha.1776572752298, =3.19.3 Source cves: CVE-2026-53632 Source advisory: GHSA-V6WH-96G9-6WX3...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) +1 more potentially affected by CVE-2026-53632 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =3.15.0-alpha.1776572752298, =3.19.3 Source cves: CVE-2026-53632 Source advisory: OSV:GHSA-V6WH-96G9-6WX3...

NPM: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

NPM: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows vulnerability discovered by ? in WordPress Npm vite-plus versions = 0.1.23...

NPM: vite: `server.fs.deny` bypass on Windows alternate paths

NPM: vite: server.fs.deny bypass on Windows alternate paths vulnerability discovered by ? in WordPress Npm vite-plus versions = 0.1.23...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) +1 more potentially affected by CVE-2026-53571 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =3.15.0-alpha.1776572752298, =3.19.3 Source cves: CVE-2026-53571 Source advisory: GHSA-FX2H-PF6J-XCFF...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) +1 more potentially affected by CVE-2026-53571 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =3.15.0-alpha.1776572752298, =3.19.3 Source cves: CVE-2026-53571 Source advisory: OSV:GHSA-FX2H-PF6J-XCFF...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) +1 more potentially affected by CVE-2026-53571 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =3.15.0-alpha.1776572752298, =3.19.3 Source cves: CVE-2026-53571 Source advisory: SNYK:JS-VITEPLUS-17353903...

CVE-2026-41211

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, downloadPackageManager accepts an untrusted version string and uses it directly in filesystem paths. A caller can supply ../ segments or an absolute path to escape the VPHOME/packagemanager// cache root and...