@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) potentially affected by CVE-2026-53571 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =0.5.0 Source cves: CVE-2026-53571 Source advisory: MEND:CVE-2026-53571...

NPM: Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

NPM: Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE vulnerability discovered by ? in WordPress Npm vite-plus versions = 0.1.23...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) potentially affected by CVE-2026-53633 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =0.5.0 Source cves: CVE-2026-53633 Source advisory: OSV:GHSA-G8MR-85JM-7XHM...

NPM: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

NPM: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows vulnerability discovered by ? in WordPress Npm vite-plus versions = 0.1.23...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) potentially affected by CVE-2026-53632 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =0.5.0 Source cves: CVE-2026-53632 Source advisory: OSV:GHSA-V6WH-96G9-6WX3...

NPM: vite: `server.fs.deny` bypass on Windows alternate paths

NPM: vite: server.fs.deny bypass on Windows alternate paths vulnerability discovered by ? in WordPress Npm vite-plus versions = 0.1.23...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) potentially affected by CVE-2026-53571 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =0.5.0 Source cves: CVE-2026-53571 Source advisory: SNYK:JS-VITEPLUS-17353903...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) potentially affected by CVE-2026-53571 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =0.5.0 Source cves: CVE-2026-53571 Source advisory: OSV:GHSA-FX2H-PF6J-XCFF...

@slidev-react/cli (>=0.4.6, <=0.5.0), @slidev-react/node (>=0.4.6, <=0.5.0) potentially affected by CVE-2026-53571 via vite-plus (>=0.1.11, <=0.1.19)

vite-plus NPM version =0.1.11, =0.4.6, =0.4.6, =0.5.0 Source cves: CVE-2026-53571 Source advisory: GHSA-FX2H-PF6J-XCFF...

CVE-2026-41211

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, downloadPackageManager accepts an untrusted version string and uses it directly in filesystem paths. A caller can supply ../ segments or an absolute path to escape the VPHOME/packagemanager// cache root and...

CVE-2026-41211

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, downloadPackageManager accepts an untrusted version string and uses it directly in filesystem paths. A caller can supply ../ segments or an absolute path to escape the VPHOME/packagemanager// cache root and...

CVE-2026-41211 `vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME`

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, downloadPackageManager accepts an untrusted version string and uses it directly in filesystem paths. A caller can supply ../ segments or an absolute path to escape the VPHOME/packagemanager// cache root and...

CVE-2026-41211

Summary of CVE-2026-41211 (vite-plus/binding) : The vulnerability affects Vite+ before version 0.1.17, where downloadPackageManager() uses an untrusted version string directly in filesystem paths. An attacker can supply traversal segments (e.g., ../) or absolute paths to escape VP_HOME/package_ma...

CVE-2026-41211 `vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME`

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, downloadPackageManager accepts an untrusted version string and uses it directly in filesystem paths. A caller can supply ../ segments or an absolute path to escape the VPHOME/packagemanager// cache root and...

CVE-2026-41211 `vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME`

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, downloadPackageManager accepts an untrusted version string and uses it directly in filesystem paths. A caller can supply ../ segments or an absolute path to escape the VPHOME/packagemanager// cache root and...

PT-2026-34601

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, downloadPackageManager accepts an untrusted version string and uses it directly in filesystem paths. A caller can supply ../ segments or an absolute path to escape the VP HOME/package manager// cache root a...

@slidev-react/cli (>=0.4.6, <=0.4.14), @slidev-react/node (>=0.4.6, <=0.4.14) potentially affected by CVE-2026-41211 via vite-plus (0.1.11)

vite-plus NPM version 0.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on vite-plus and may be impacted: - @slidev-react/cli =0.4.6, =0.4.6, =0.4.14 Source cves: CVE-2026-41211 Source advisory: OSV:GHSA-33R3-4WHC-44C2...

GHSA-33R3-4WHC-44C2 Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME

Summary downloadPackageManager in vite-plus/binding accepts an untrusted version string and uses it directly in filesystem paths. A caller can supply ../ segments to escape the VPHOME/packagemanager// cache root and cause Vite+ to delete, replace, and populate directories outside the intended cac...

Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME

Summary downloadPackageManager in vite-plus/binding accepts an untrusted version string and uses it directly in filesystem paths. A caller can supply ../ segments to escape the VPHOME/packagemanager// cache root and cause Vite+ to delete, replace, and populate directories outside the intended cac...

PT-2026-35181

Summary downloadPackageManager in vite-plus/binding accepts an untrusted version string and uses it directly in filesystem paths. A caller can supply ../ segments to escape the VP HOME/package manager// cache root and cause Vite+ to delete, replace, and populate directories outside the intended...