{ "@id": "urn:uuid:2b90bbd2-7b50-4397-b4d2-3170bf555434", "role": "Document Creator", "author": "https://tuxcare.com", "version": 17, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T15:00:55.323785+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 4.5.0-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 4.5.0-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 4.5.0-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 4.5.0-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-16T15:11:00.074533+00:00", "status_notes": "Vulnerability CVE-2023-49293 affects version 4.5.0-tuxcare.2 of vite, and is fixed in 4.5.0-tuxcare.4.", "vulnerability": { "name": "CVE-2023-49293" }, "action_statement": "Vulnerability CVE-2023-49293 affects version 4.5.0-tuxcare.2 of vite, and is fixed in 4.5.0-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-16T15:11:00.074533+00:00", "status_notes": "Vulnerability CVE-2024-23331 affects version 4.5.0-tuxcare.2 of vite, and is fixed in 4.5.0-tuxcare.4.", "vulnerability": { "name": "CVE-2024-23331" }, "action_statement": "Vulnerability CVE-2024-23331 affects version 4.5.0-tuxcare.2 of vite, and is fixed in 4.5.0-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-16T15:11:00.074533+00:00", "status_notes": "Vulnerability CVE-2024-31207 affects version 4.5.0-tuxcare.2 of vite, and is fixed in 4.5.0-tuxcare.4.", "vulnerability": { "name": "CVE-2024-31207" }, "action_statement": "Vulnerability CVE-2024-31207 affects version 4.5.0-tuxcare.2 of vite, and is fixed in 4.5.0-tuxcare.4." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-12T12:26:00.050264+00:00", "status_notes": "Vulnerability CVE-2024-45811 is fixed in version 4.5.0-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2024-45811" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-16T15:11:00.074533+00:00", "status_notes": "Vulnerability CVE-2024-45812 affects version 4.5.0-tuxcare.2 of vite, and is fixed in 4.5.0-tuxcare.4.", "vulnerability": { "name": "CVE-2024-45812" }, "action_statement": "Vulnerability CVE-2024-45812 affects version 4.5.0-tuxcare.2 of vite, and is fixed in 4.5.0-tuxcare.4." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-12T12:26:00.050264+00:00", "status_notes": "Vulnerability CVE-2024-52011 is fixed in version 4.5.0-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2024-52011" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-15T12:13:41.094671+00:00", "status_notes": "Vulnerability CVE-2025-24010 affects version 4.5.0-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2025-24010" }, "action_statement": "Vulnerability CVE-2025-24010 affects version 4.5.0-tuxcare.2 of vite." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-12T12:26:00.050264+00:00", "status_notes": "Vulnerability CVE-2025-30208 is fixed in version 4.5.0-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2025-30208" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-12T12:26:00.050264+00:00", "status_notes": "Vulnerability CVE-2025-31125 is fixed in version 4.5.0-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2025-31125" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-15T12:13:41.094671+00:00", "status_notes": "Vulnerability CVE-2025-31486 affects version 4.5.0-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2025-31486" }, "action_statement": "Vulnerability CVE-2025-31486 affects version 4.5.0-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-15T12:13:41.094671+00:00", "status_notes": "Vulnerability CVE-2025-32395 affects version 4.5.0-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2025-32395" }, "action_statement": "Vulnerability CVE-2025-32395 affects version 4.5.0-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-15T12:13:41.094671+00:00", "status_notes": "Vulnerability CVE-2025-46565 affects version 4.5.0-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2025-46565" }, "action_statement": "Vulnerability CVE-2025-46565 affects version 4.5.0-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-15T12:13:41.094671+00:00", "status_notes": "Vulnerability CVE-2025-58751 affects version 4.5.0-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2025-58751" }, "action_statement": "Vulnerability CVE-2025-58751 affects version 4.5.0-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-15T12:13:41.094671+00:00", "status_notes": "Vulnerability CVE-2025-58752 affects version 4.5.0-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2025-58752" }, "action_statement": "Vulnerability CVE-2025-58752 affects version 4.5.0-tuxcare.2 of vite." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-12T12:26:00.050264+00:00", "status_notes": "Vulnerability CVE-2025-62522 is fixed in version 4.5.0-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2025-62522" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-11-06T15:00:55.323785+00:00", "status_notes": "Vulnerability CVE-2026-112942 affects version 4.5.0-tuxcare.2 of vite, and is fixed in 4.5.0-tuxcare.7.", "vulnerability": { "name": "CVE-2026-112942" }, "action_statement": "Vulnerability CVE-2026-112942 affects version 4.5.0-tuxcare.2 of vite, and is fixed in 4.5.0-tuxcare.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-11-06T14:48:00.048187+00:00", "status_notes": "Vulnerability CVE-2026-112943 does not affect version 4.5.0-tuxcare.2 of vite. Not affected launch-editor cmd.exe injection (Windows). Launch command built from file name without rejecting `%` or line breaks, so cmd.exe expands %VAR% / %VAR:old=new% and a CR/LF splits off a new command. Already covered: vite bundles launch-editor(-middleware) 2.14.2 since 8f9f7bf2e (deps bump). 2.14.2 has upstream fix vitejs/launch-editor 3c2f9bf (#155): constructWindowsLaunchCommand rejects `%` and CR/LF; error goes to onErrorCallback, no editor launched. No code change on this line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112943" }, "impact_statement": "Not affected launch-editor cmd.exe injection (Windows). Launch command built from file name without rejecting `%` or line breaks, so cmd.exe expands %VAR% / %VAR:old=new% and a CR/LF splits off a new command. Already covered: vite bundles launch-editor(-middleware) 2.14.2 since 8f9f7bf2e (deps bump). 2.14.2 has upstream fix vitejs/launch-editor 3c2f9bf (#155): constructWindowsLaunchCommand rejects `%` and CR/LF; error goes to onErrorCallback, no editor launched. No code change on this line." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-20T20:47:00.216698+00:00", "status_notes": "Vulnerability CVE-2026-112944 does not affect version 4.5.0-tuxcare.2 of vite. not_affected \u2014 Vite 4.5.0 uses launch-editor-middleware v2.14.1, which includes runtime protection against CVE-2026-112944 by converting file paths to absolute paths before passing them to editors. This prevents paths starting with '+' or '-' from being interpreted as CLI flags. The CVE states that this protection is effective for non-WSL users. While WSL users may have limited protection due to internal WSL ...", "vulnerability": { "name": "CVE-2026-112944" }, "impact_statement": "not_affected \u2014 Vite 4.5.0 uses launch-editor-middleware v2.14.1, which includes runtime protection against CVE-2026-112944 by converting file paths to absolute paths before passing them to editors. This prevents paths starting with '+' or '-' from being interpreted as CLI flags. The CVE states that this protection is effective for non-WSL users. While WSL users may have limited protection due to internal WSL ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-11-06T15:00:55.323785+00:00", "status_notes": "Vulnerability CVE-2026-112945 affects version 4.5.0-tuxcare.2 of vite, and is fixed in 4.5.0-tuxcare.7.", "vulnerability": { "name": "CVE-2026-112945" }, "action_statement": "Vulnerability CVE-2026-112945 affects version 4.5.0-tuxcare.2 of vite, and is fixed in 4.5.0-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-27T10:47:00.133696+00:00", "status_notes": "Vulnerability CVE-2026-112946 affects version 4.5.0-tuxcare.2 of vite, and is fixed in 4.5.0-tuxcare.6.", "vulnerability": { "name": "CVE-2026-112946" }, "action_statement": "Vulnerability CVE-2026-112946 affects version 4.5.0-tuxcare.2 of vite, and is fixed in 4.5.0-tuxcare.6." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-11-04T02:58:06.245145+00:00", "status_notes": "Vulnerability CVE-2026-112947 does not affect version 4.5.0-tuxcare.2 of vite. not_affected \u2014 Target version 4.5.0-tuxcare.6 is NOT AFFECTED. The vulnerability (CVE-2026-112947) requires the WASM ESM Integration feature that handles `?vite-wasm-instance` query parameters, which was introduced in Vite v8.1.0 (commit c23d85b96, July 2026). The target version 4.5.0 predates this feature by several major versions. The vulnerable code path\u2014specifically the wasm plugin's load hook that strips...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112947" }, "impact_statement": "not_affected \u2014 Target version 4.5.0-tuxcare.6 is NOT AFFECTED. The vulnerability (CVE-2026-112947) requires the WASM ESM Integration feature that handles `?vite-wasm-instance` query parameters, which was introduced in Vite v8.1.0 (commit c23d85b96, July 2026). The target version 4.5.0 predates this feature by several major versions. The vulnerable code path\u2014specifically the wasm plugin's load hook that strips..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-29T16:45:45.459074+00:00", "status_notes": "Vulnerability CVE-2026-118662 affects version 4.5.0-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-118662" }, "action_statement": "Vulnerability CVE-2026-118662 affects version 4.5.0-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-30T14:48:00.154664+00:00", "status_notes": "Vulnerability CVE-2026-39363 affects version 4.5.0-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-39363" }, "action_statement": "Vulnerability CVE-2026-39363 affects version 4.5.0-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-30T14:48:00.154664+00:00", "status_notes": "Vulnerability CVE-2026-39364 affects version 4.5.0-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-39364" }, "action_statement": "Vulnerability CVE-2026-39364 affects version 4.5.0-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-15T12:13:41.094671+00:00", "status_notes": "Vulnerability CVE-2026-39365 affects version 4.5.0-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-39365" }, "action_statement": "Vulnerability CVE-2026-39365 affects version 4.5.0-tuxcare.2 of vite." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-12T12:26:00.050264+00:00", "status_notes": "Vulnerability CVE-2026-53571 is fixed in version 4.5.0-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-53571" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@4.5.0-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@4.5.0-tuxcare.2" } } ], "timestamp": "2026-10-12T19:34:00.110067+00:00", "status_notes": "Vulnerability CVE-2026-53632 affects version 4.5.0-tuxcare.2 of vite, and is fixed in 4.5.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-53632" }, "action_statement": "Vulnerability CVE-2026-53632 affects version 4.5.0-tuxcare.2 of vite, and is fixed in 4.5.0-tuxcare.3." } ] }