1016 matches found
Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers
Cybersecurity researchers have disclosed details of a mass-scanning campaign that has targeted Vite deployments siphon sensitive data. The first is an automated effort aimed at internet-exposed Vite development servers that's designed to steal cloud credentials, configurations from Amazon Web...
VulnCheck KEV: CVE-2024-45811
Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. @fs denies access to files outside of Vite serving allow list. Adding ?import&raw to the URL bypasses this limitation and returns the file content if it...
VulnCheck KEV: CVE-2026-39364
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny e.g., .env, .crt can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are...
CLSA-2026-1789032018 TuxCare security update for vite (2 CVEs)
TuxCare rebuilt vite to address 2 CVEs. Fixed in 8.0.8-tuxcare.1...
CLSA-2026-1789031855 TuxCare security update for vite (16 CVEs)
TuxCare rebuilt vite to address 16 CVEs. Fixed in 4.1.5-tuxcare.1...
CLSA-2026-1788976472 TuxCare security update for vite (1 CVE)
TuxCare rebuilt vite to address 1 CVE. Fixed in 6.4.2-tuxcare.2...
CLSA-2026-1788976179 TuxCare security update for vite (2 CVEs)
TuxCare rebuilt vite to address 2 CVEs. Fixed in 7.3.2-tuxcare.1...
CLSA-2026-1788967519 TuxCare security update for vite (2 CVEs)
TuxCare rebuilt vite to address 2 CVEs. Fixed in 8.0.10-tuxcare.1...
CLSA-2026-1788966294 TuxCare security update for vite (2 CVEs)
TuxCare rebuilt vite to address 2 CVEs. Fixed in 8.0.12-tuxcare.1...
EUVD-2026-69705
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock...
GHSA-82FW-GWWQ-J7X9 Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
Summary @vitest/mocker registers a redirect mock's target path without validating it against the dev server's file-serving allowlist. An attacker who can reach the dev server's WebSocket can register a redirect mock pointing outside the project root; when the mocked module is requested, the...
Vite - Information Disclosure
Vite is a frontend tooling framework for JavaScript.In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended wi...
ROOT-APP-NPM-CVE-2026-53571 CVE-2026-53571 in vite - Patched by Root
Root has patched CVE-2026-53571 in the vite package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-39363 CVE-2026-39363 in vite - Patched by Root
Root has patched CVE-2026-39363 in the vite package for Root:npm. Multiple fixed versions available...
CLSA-2026-1787839491 TuxCare security update for vite (1 CVE)
TuxCare rebuilt vite to address 1 CVE. Fixed in 6.4.2-tuxcare.1...
CVE-2026-78177
A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...
CVE-2026-78177 TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection
A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...
EUVD-2026-64694
A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...
CVE-2026-78177 TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection
A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...
CVE-2026-78177 TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection
A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...