{
  "@id": "urn:uuid:7c63ce89-b57f-47f2-8d4a-ca91a790f41e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T16:51:00.076721+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.3.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.3.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T16:51:00.076721+00:00",
      "status_notes": "Vulnerability CVE-2026-112942 is fixed in version 0.3.3-tuxcare.1 of vite-plus.",
      "vulnerability": {
        "name": "CVE-2026-112942"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.3.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.3.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T16:51:00.076721+00:00",
      "status_notes": "Vulnerability CVE-2026-112943 is fixed in version 0.3.3-tuxcare.1 of vite-plus.",
      "vulnerability": {
        "name": "CVE-2026-112943"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.3.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.3.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T16:51:00.076721+00:00",
      "status_notes": "Vulnerability CVE-2026-112944 is fixed in version 0.3.3-tuxcare.1 of vite-plus.",
      "vulnerability": {
        "name": "CVE-2026-112944"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.3.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.3.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T16:51:00.076721+00:00",
      "status_notes": "Vulnerability CVE-2026-112945 is fixed in version 0.3.3-tuxcare.1 of vite-plus.",
      "vulnerability": {
        "name": "CVE-2026-112945"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.3.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.3.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T16:51:00.076721+00:00",
      "status_notes": "Vulnerability CVE-2026-112946 is fixed in version 0.3.3-tuxcare.1 of vite-plus.",
      "vulnerability": {
        "name": "CVE-2026-112946"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.3.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.3.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T16:51:00.076721+00:00",
      "status_notes": "Vulnerability CVE-2026-112947 is fixed in version 0.3.3-tuxcare.1 of vite-plus.",
      "vulnerability": {
        "name": "CVE-2026-112947"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.3.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.3.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T16:50:24.364894+00:00",
      "status_notes": "Vulnerability CVE-2026-112948 does not affect version 0.3.3-tuxcare.1 of vite-plus. not_affected \u2014 Target repository (vite-plus v0.3.3) uses Vitest 4.1.11 as a declared dependency. CVE-2026-112948 explicitly states \"Vitest 4 and earlier are unaffected\" because they don't persist an API token and don't override server.fs.deny. The vulnerable code pattern (incorrect server.fs.deny configuration causing sensitive file disclosure in Vitest's dev servers) exists only in Vitest 5. The target versi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-112948"
      },
      "impact_statement": "not_affected \u2014 Target repository (vite-plus v0.3.3) uses Vitest 4.1.11 as a declared dependency. CVE-2026-112948 explicitly states \"Vitest 4 and earlier are unaffected\" because they don't persist an API token and don't override server.fs.deny. The vulnerable code pattern (incorrect server.fs.deny configuration causing sensitive file disclosure in Vitest's dev servers) exists only in Vitest 5. The target versi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.3.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.3.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T16:50:24.364894+00:00",
      "status_notes": "Vulnerability CVE-2026-41211 does not affect version 0.3.3-tuxcare.1 of vite-plus. not_affected \u2014 CVE-2026-41211 describes a path traversal vulnerability in `downloadPackageManager()` where an untrusted `version` string containing `../` sequences could escape the VP_HOME cache directory. The target repository (vite-plus v0.3.3) contains an upstream fix that validates the version string using `Version::parse()` to enforce strict semver format, rejecting path traversal attempts before any fil...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41211"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-41211 describes a path traversal vulnerability in `downloadPackageManager()` where an untrusted `version` string containing `../` sequences could escape the VP_HOME cache directory. The target repository (vite-plus v0.3.3) contains an upstream fix that validates the version string using `Version::parse()` to enforce strict semver format, rejecting path traversal attempts before any fil..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.3.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.3.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T16:50:24.364894+00:00",
      "status_notes": "Vulnerability CVE-2026-53571 does not affect version 0.3.3-tuxcare.1 of vite-plus. Not affected: the versions shipped with vite-plus 0.3.3 (vite@8.3.0 (bundled); vite@8.3.7 (npm)) are outside the advisory's vulnerable range. Checked against the published tarball and the npm tree on 2026-11-09.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-53571"
      },
      "impact_statement": "Not affected: the versions shipped with vite-plus 0.3.3 (vite@8.3.0 (bundled); vite@8.3.7 (npm)) are outside the advisory's vulnerable range. Checked against the published tarball and the npm tree on 2026-11-09."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.3.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.3.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T16:50:24.364894+00:00",
      "status_notes": "Vulnerability CVE-2026-53632 does not affect version 0.3.3-tuxcare.1 of vite-plus. not_affected \u2014 The target repository (vite-plus-monorepo v0.3.3) is not affected by CVE-2026-53632. The vulnerability concerns the launch-editor package's handling of Windows UNC paths, which can leak NTLM credentials. While vite-plus bundles Vite at build time (and Vite uses launch-editor-middleware), the actual Vite source code and launch-editor code are NOT present in this source repository at the analyzed...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-53632"
      },
      "impact_statement": "not_affected \u2014 The target repository (vite-plus-monorepo v0.3.3) is not affected by CVE-2026-53632. The vulnerability concerns the launch-editor package's handling of Windows UNC paths, which can leak NTLM credentials. While vite-plus bundles Vite at build time (and Vite uses launch-editor-middleware), the actual Vite source code and launch-editor code are NOT present in this source repository at the analyzed..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite-plus@0.3.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite-plus@0.3.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-11T16:50:24.364894+00:00",
      "status_notes": "Vulnerability CVE-2026-53633 does not affect version 0.3.3-tuxcare.1 of vite-plus. Not affected: the versions shipped with vite-plus 0.3.3 (@vitest/browser@4.1.11 (npm)) are outside the advisory's vulnerable range. Checked against the published tarball and the npm tree on 2026-11-09.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-53633"
      },
      "impact_statement": "Not affected: the versions shipped with vite-plus 0.3.3 (@vitest/browser@4.1.11 (npm)) are outside the advisory's vulnerable range. Checked against the published tarball and the npm tree on 2026-11-09."
    }
  ]
}