{
  "@id": "urn:uuid:a01a1156-779b-4d0e-8e4b-97e2d0c529c8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T15:13:41.754613+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T15:13:41.754613+00:00",
      "status_notes": "Vulnerability CVE-2026-112942 is fixed in version 0.2.7-tuxcare.1 of vite-plus.",
      "vulnerability": {
        "name": "CVE-2026-112942"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T15:13:41.754613+00:00",
      "status_notes": "Vulnerability CVE-2026-112943 is fixed in version 0.2.7-tuxcare.1 of vite-plus.",
      "vulnerability": {
        "name": "CVE-2026-112943"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T15:13:41.754613+00:00",
      "status_notes": "Vulnerability CVE-2026-112944 is fixed in version 0.2.7-tuxcare.1 of vite-plus.",
      "vulnerability": {
        "name": "CVE-2026-112944"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T15:13:41.754613+00:00",
      "status_notes": "Vulnerability CVE-2026-112945 is fixed in version 0.2.7-tuxcare.1 of vite-plus.",
      "vulnerability": {
        "name": "CVE-2026-112945"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T15:13:41.754613+00:00",
      "status_notes": "Vulnerability CVE-2026-112946 is fixed in version 0.2.7-tuxcare.1 of vite-plus.",
      "vulnerability": {
        "name": "CVE-2026-112946"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T15:13:28.860595+00:00",
      "status_notes": "Vulnerability CVE-2026-112947 does not affect version 0.2.7-tuxcare.1 of vite-plus. Not affected: the versions shipped with vite-plus 0.2.7 (vite@8.1.5 (bundled); vite@8.3.7 (npm)) are outside the advisory's vulnerable range. Checked against the published tarball and the npm tree on 2026-11-09.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-112947"
      },
      "impact_statement": "Not affected: the versions shipped with vite-plus 0.2.7 (vite@8.1.5 (bundled); vite@8.3.7 (npm)) are outside the advisory's vulnerable range. Checked against the published tarball and the npm tree on 2026-11-09."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T15:13:28.860595+00:00",
      "status_notes": "Vulnerability CVE-2026-112948 does not affect version 0.2.7-tuxcare.1 of vite-plus. not_affected \u2014 Vite-plus version 0.2.7 is not affected by CVE-2026-112948. The CVE describes a vulnerability in Vitest 5's handling of server.fs.deny when running HTTP dev servers (--ui, browser mode, or api enabled). Vite-plus depends on Vitest 4.1.10, which the CVE explicitly excludes: \"Vitest 4 and earlier are unaffected. They don't persist an API token, and they don't override server.fs.deny.\" Additionall...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-112948"
      },
      "impact_statement": "not_affected \u2014 Vite-plus version 0.2.7 is not affected by CVE-2026-112948. The CVE describes a vulnerability in Vitest 5's handling of server.fs.deny when running HTTP dev servers (--ui, browser mode, or api enabled). Vite-plus depends on Vitest 4.1.10, which the CVE explicitly excludes: \"Vitest 4 and earlier are unaffected. They don't persist an API token, and they don't override server.fs.deny.\" Additionall..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T15:13:28.860595+00:00",
      "status_notes": "Vulnerability CVE-2026-41211 does not affect version 0.2.7-tuxcare.1 of vite-plus. not_affected \u2014 The path traversal vulnerability described in CVE-2026-41211 is NOT PRESENT in vite-plus v0.2.7. The upstream fix (commit e159b84a9) that validates version strings to reject path traversal sequences was added in v0.1.17 and is present in the target version. The binding's downloadPackageManager() function calls vite_install::download_package_manager() which performs strict semver validation via ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41211"
      },
      "impact_statement": "not_affected \u2014 The path traversal vulnerability described in CVE-2026-41211 is NOT PRESENT in vite-plus v0.2.7. The upstream fix (commit e159b84a9) that validates version strings to reject path traversal sequences was added in v0.1.17 and is present in the target version. The binding's downloadPackageManager() function calls vite_install::download_package_manager() which performs strict semver validation via ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T15:13:28.860595+00:00",
      "status_notes": "Vulnerability CVE-2026-53571 does not affect version 0.2.7-tuxcare.1 of vite-plus. Not affected: the versions shipped with vite-plus 0.2.7 (vite@8.1.5 (bundled); vite@8.3.7 (npm)) are outside the advisory's vulnerable range. Checked against the published tarball and the npm tree on 2026-11-09.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-53571"
      },
      "impact_statement": "Not affected: the versions shipped with vite-plus 0.2.7 (vite@8.1.5 (bundled); vite@8.3.7 (npm)) are outside the advisory's vulnerable range. Checked against the published tarball and the npm tree on 2026-11-09."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T15:13:28.860595+00:00",
      "status_notes": "Vulnerability CVE-2026-53632 does not affect version 0.2.7-tuxcare.1 of vite-plus. not_affected \u2014 The target repository (vite-plus v0.2.7) does not contain the vulnerable code at commit 2c8382314589f2d12f3ebb8885bc5f051b44e707. While vite-plus is documented to bundle Vite source code (which uses the vulnerable launch-editor package), the Vite source directory (../../vite/packages/vite) does not exist in this checkout. No git submodules are configured (.gitmodules file absent), and vite-plus...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-53632"
      },
      "impact_statement": "not_affected \u2014 The target repository (vite-plus v0.2.7) does not contain the vulnerable code at commit 2c8382314589f2d12f3ebb8885bc5f051b44e707. While vite-plus is documented to bundle Vite source code (which uses the vulnerable launch-editor package), the Vite source directory (../../vite/packages/vite) does not exist in this checkout. No git submodules are configured (.gitmodules file absent), and vite-plus..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T15:13:28.860595+00:00",
      "status_notes": "Vulnerability CVE-2026-53633 does not affect version 0.2.7-tuxcare.1 of vite-plus. Not affected: the versions shipped with vite-plus 0.2.7 (@vitest/browser@4.1.10 (npm)) are outside the advisory's vulnerable range. Checked against the published tarball and the npm tree on 2026-11-09.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-53633"
      },
      "impact_statement": "Not affected: the versions shipped with vite-plus 0.2.7 (@vitest/browser@4.1.10 (npm)) are outside the advisory's vulnerable range. Checked against the published tarball and the npm tree on 2026-11-09."
    }
  ]
}