@amitkaps/sitez (0.2.0), @kekkon-nexus/create-config (>=3.2.0, <=3.3.0) +9 more potentially affected by CVE-2026-112948 via vite-plus (>=1.0.0-rc.0, <=1.2.0)

vite-plus NPM version =1.0.0-rc.0, =3.2.0, =0.1.0, =0.1.0, =0.2.0, =1.0.0, =1.1.1, =1.0.0, =1.6.0, =1.8.1 - @varlet/cli 3.20.8 Source cves: CVE-2026-112948 Source advisory: GHSA-P458-7748-MCP3...

npm: Vite: Cross origin script execution through Vite custom middleware

npm: Vite: Cross origin script execution through Vite custom middleware vulnerability discovered by ? in WordPress npm vite-plus versions = 1.0.0...

@amitkaps/sitez (0.2.0), @kekkon-nexus/create-config (>=3.2.0, <=3.3.0) potentially affected by CVE-2026-112945 via vite-plus (>=1.0.0-rc.0, <=1.0.0)

vite-plus NPM version =1.0.0-rc.0, =3.2.0, =3.3.0 Source cves: CVE-2026-112945 Source advisory: OSV:GHSA-9JRQ-W75R-8GCW...

@amitkaps/sitez (0.2.0), @kekkon-nexus/create-config (>=3.2.0, <=3.3.0) potentially affected by CVE-2026-112945 via vite-plus (>=1.0.0-rc.0, <=1.0.0)

vite-plus NPM version =1.0.0-rc.0, =3.2.0, =3.3.0 Source cves: CVE-2026-112945 Source advisory: GHSA-9JRQ-W75R-8GCW...

npm: Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

npm: Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machine vulnerability discovered by ? in WordPress npm vite-plus versions = 1.0.0...

@amitkaps/sitez (0.2.0), @kekkon-nexus/create-config (>=3.2.0, <=3.3.0) potentially affected by CVE-2026-112946 via vite-plus (>=1.0.0-rc.0, <=1.0.0)

vite-plus NPM version =1.0.0-rc.0, =3.2.0, =3.3.0 Source cves: CVE-2026-112946 Source advisory: GHSA-RQ7H-C2JC-7F22...

@amitkaps/sitez (0.2.0), @kekkon-nexus/create-config (>=3.2.0, <=3.3.0) potentially affected by CVE-2026-112946 via vite-plus (>=1.0.0-rc.0, <=1.0.0)

vite-plus NPM version =1.0.0-rc.0, =3.2.0, =3.3.0 Source cves: CVE-2026-112946 Source advisory: OSV:GHSA-RQ7H-C2JC-7F22...

@amitkaps/sitez (0.2.0), @dpeek/formless (>=0.1.12, <=0.1.18) +11 more potentially affected by CVE-2026-112947 via vite-plus (>=0.2.9, <=1.0.0)

vite-plus NPM version =0.2.9, =0.1.12, =0.4.3, =0.0.2, =1.0.9, =0.0.0, =3.0.0, =0.1.0, =0.0.24, =0.17.1, =1.1.0, =0.0.1, =0.6.0 Source cves: CVE-2026-112947 Source advisory: GHSA-VFPM-58RQ-9QCG...

@amitkaps/sitez (0.2.0), @dpeek/formless (>=0.1.12, <=0.1.18) +11 more potentially affected by CVE-2026-112947 via vite-plus (>=0.2.9, <=1.0.0)

vite-plus NPM version =0.2.9, =0.1.12, =0.4.3, =0.0.2, =1.0.9, =0.0.0, =3.0.0, =0.1.0, =0.0.24, =0.17.1, =1.1.0, =0.0.1, =0.6.0 Source cves: CVE-2026-112947 Source advisory: OSV:GHSA-VFPM-58RQ-9QCG...

@amitkaps/sitez (0.2.0), @kekkon-nexus/create-config (>=3.2.0, <=3.3.0) potentially affected by CVE-2026-112944 via vite-plus (>=1.0.0-rc.0, <=1.0.0)

vite-plus NPM version =1.0.0-rc.0, =3.2.0, =3.3.0 Source cves: CVE-2026-112944 Source advisory: GHSA-R825-W8MM-5PXW...

@amitkaps/sitez (0.2.0), @kekkon-nexus/create-config (>=3.2.0, <=3.3.0) potentially affected by CVE-2026-112944 via vite-plus (>=1.0.0-rc.0, <=1.0.0)

vite-plus NPM version =1.0.0-rc.0, =3.2.0, =3.3.0 Source cves: CVE-2026-112944 Source advisory: OSV:GHSA-R825-W8MM-5PXW...

@amitkaps/sitez (0.2.0), @kekkon-nexus/create-config (>=3.2.0, <=3.3.0) potentially affected by CVE-2026-112944 via vite-plus (>=1.0.0-rc.0, <=1.0.0)

vite-plus NPM version =1.0.0-rc.0, =3.2.0, =3.3.0 Source cves: CVE-2026-112944 Source advisory: SNYK:JS-VITEPLUS-21282011...

npm: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

npm: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors vulnerability discovered by ? in WordPress npm vite-plus versions = 1.0.0...

Arbitrary Argument Injection

Overview vite-plus is a The Unified Toolchain for the Web Affected versions of this package are vulnerable to Arbitrary Argument Injection via the getArgumentsForFile function in packages/launch-editor/get-args.js, where a filename is passed directly to an editor process without being resolved to...

@amitkaps/sitez (0.2.0), @kekkon-nexus/create-config (>=3.2.0, <=3.3.0) potentially affected by CVE-2026-112942 via vite-plus (>=1.0.0-rc.0, <=1.0.0)

vite-plus NPM version =1.0.0-rc.0, =3.2.0, =3.3.0 Source cves: CVE-2026-112942 Source advisory: GHSA-587H-7WMJ-H5PM...

@amitkaps/sitez (0.2.0), @kekkon-nexus/create-config (>=3.2.0, <=3.3.0) potentially affected by CVE-2026-112942 via vite-plus (>=1.0.0-rc.0, <=1.0.0)

vite-plus NPM version =1.0.0-rc.0, =3.2.0, =3.3.0 Source cves: CVE-2026-112942 Source advisory: OSV:GHSA-587H-7WMJ-H5PM...

@amitkaps/sitez (0.2.0), @kekkon-nexus/create-config (>=3.2.0, <=3.3.0) potentially affected by CVE-2026-112942 via vite-plus (>=1.0.0-rc.0, <=1.0.0)

vite-plus NPM version =1.0.0-rc.0, =3.2.0, =3.3.0 Source cves: CVE-2026-112942 Source advisory: SNYK:JS-VITEPLUS-21282023...

npm: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

npm: launch-editor: fs.existsSync existence check can be bypassed on Windows vulnerability discovered by ? in WordPress npm vite-plus versions = 1.0.0...

Arbitrary Command Injection

Overview vite-plus is a The Unified Toolchain for the Web Affected versions of this package are vulnerable to Arbitrary Command Injection via the parseFile function in packages/launch-editor/index.js, which previously resolved file paths only after stripping position suffixes without calling...

@amitkaps/sitez (0.2.0), @kekkon-nexus/create-config (>=3.2.0, <=3.3.0) potentially affected by CVE-2026-112943 via vite-plus (>=1.0.0-rc.0, <=1.0.0)

vite-plus NPM version =1.0.0-rc.0, =3.2.0, =3.3.0 Source cves: CVE-2026-112943 Source advisory: GHSA-698V-4R3X-3VCV...