{ "@id": "urn:uuid:627d3d0a-3a37-4536-aed9-ec4cb4e261fb", "role": "Document Creator", "author": "https://tuxcare.com", "version": 11, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T04:52:00.041416+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-49293 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2023-49293" }, "action_statement": "Vulnerability CVE-2023-49293 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-23331 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2024-23331" }, "action_statement": "Vulnerability CVE-2024-23331 affects version 5.4.12 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-03T23:49:23.809666+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 5.4.12 of vite. not_affected \u2014 The target repository (vite 5.4.12) is not affected by CVE-2024-31207. The vulnerability\u2014caused by incorrect picomatch configuration (`matchBase: true`, missing `dot: true`) that allowed bypassing `server.fs.deny` patterns with directories\u2014was fixed in the upstream release. The fix is present in packages/vite/src/node/server/index.ts:710-722, changing `matchBase` to `false`, adding `dot: true`,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "not_affected \u2014 The target repository (vite 5.4.12) is not affected by CVE-2024-31207. The vulnerability\u2014caused by incorrect picomatch configuration (`matchBase: true`, missing `dot: true`) that allowed bypassing `server.fs.deny` patterns with directories\u2014was fixed in the upstream release. The fix is present in packages/vite/src/node/server/index.ts:710-722, changing `matchBase` to `false`, adding `dot: true`,..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-03T23:52:23.292961+00:00", "status_notes": "Vulnerability CVE-2024-45811 does not affect version 5.4.12 of vite. not_affected \u2014 The target repository (Vite v5.4.12) is not affected by CVE-2024-45811. The vulnerability pattern (processing requests with ?raw or ?url query parameters without access control validation) has been removed by an upstream fix that shipped in the v5.4.12 release. The fix (commit 6820bb3b9a) was authored by upstream Vite maintainer patak and was already present in the upstream release before TuxCa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45811" }, "impact_statement": "not_affected \u2014 The target repository (Vite v5.4.12) is not affected by CVE-2024-45811. The vulnerability pattern (processing requests with ?raw or ?url query parameters without access control validation) has been removed by an upstream fix that shipped in the v5.4.12 release. The fix (commit 6820bb3b9a) was authored by upstream Vite maintainer patak and was already present in the upstream release before TuxCa..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-45812 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2024-45812" }, "action_statement": "Vulnerability CVE-2024-45812 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-52011 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2024-52011" }, "action_statement": "Vulnerability CVE-2024-52011 affects version 5.4.12 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-03T23:57:49.636936+00:00", "status_notes": "Vulnerability CVE-2025-24010 does not affect version 5.4.12 of vite. not_affected \u2014 Target version 5.4.12 is not affected by CVE-2025-24010. All three vulnerability patterns (permissive default CORS, missing WebSocket Origin validation, missing Host header validation) were fixed by upstream commits b71a5c89a, dfea38f1f, and 9da4abc8d authored by sapphi-red, which shipped in the upstream v5.4.12 release before TuxCare onboarded it. The target contains all three security defense...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24010" }, "impact_statement": "not_affected \u2014 Target version 5.4.12 is not affected by CVE-2025-24010. All three vulnerability patterns (permissive default CORS, missing WebSocket Origin validation, missing Host header validation) were fixed by upstream commits b71a5c89a, dfea38f1f, and 9da4abc8d authored by sapphi-red, which shipped in the upstream v5.4.12 release before TuxCare onboarded it. The target contains all three security defense..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2025-30208 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2025-30208" }, "action_statement": "Vulnerability CVE-2025-30208 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2025-31125 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2025-31125" }, "action_statement": "Vulnerability CVE-2025-31125 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2025-31486 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2025-31486" }, "action_statement": "Vulnerability CVE-2025-31486 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2025-32395 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2025-32395" }, "action_statement": "Vulnerability CVE-2025-32395 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2025-46565 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2025-46565" }, "action_statement": "Vulnerability CVE-2025-46565 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2025-58751 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2025-58751" }, "action_statement": "Vulnerability CVE-2025-58751 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2025-58752 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2025-58752" }, "action_statement": "Vulnerability CVE-2025-58752 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2025-62522 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2025-62522" }, "action_statement": "Vulnerability CVE-2025-62522 affects version 5.4.12 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2026-112942 does not affect version 5.4.12 of vite. not_affected \u2014 CVE-2026-112942 describes a Windows-specific path traversal bypass in the launch-editor package that allows attackers to bypass fs.existsSync() checks using crafted paths ending in \\\\..:line:column, potentially leading to OS command injection. However, Vite's codebase does not contain the vulnerable code pattern. Vite only declares launch-editor-middleware (v^2.9.1) as a dependency and delegate...", "vulnerability": { "name": "CVE-2026-112942" }, "impact_statement": "not_affected \u2014 CVE-2026-112942 describes a Windows-specific path traversal bypass in the launch-editor package that allows attackers to bypass fs.existsSync() checks using crafted paths ending in \\\\..:line:column, potentially leading to OS command injection. However, Vite's codebase does not contain the vulnerable code pattern. Vite only declares launch-editor-middleware (v^2.9.1) as a dependency and delegate..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2026-112943 does not affect version 5.4.12 of vite. not_affected \u2014 CVE-2026-112943 describes a vulnerability in the external `launch-editor` npm package (not escaping `%` on Windows when spawning `cmd.exe`). Vite v5.4.12 declares `launch-editor-middleware@2.9.1` (which depends on `launch-editor@2.9.1`) as a dependency but does NOT vendor the code. The vulnerable code pattern is not present in the Vite repository itself\u2014it exists only in the external dependency...", "vulnerability": { "name": "CVE-2026-112943" }, "impact_statement": "not_affected \u2014 CVE-2026-112943 describes a vulnerability in the external `launch-editor` npm package (not escaping `%` on Windows when spawning `cmd.exe`). Vite v5.4.12 declares `launch-editor-middleware@2.9.1` (which depends on `launch-editor@2.9.1`) as a dependency but does NOT vendor the code. The vulnerable code pattern is not present in the Vite repository itself\u2014it exists only in the external dependency..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2026-112944 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2026-112944" }, "action_statement": "Vulnerability CVE-2026-112944 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2026-112945 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2026-112945" }, "action_statement": "Vulnerability CVE-2026-112945 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2026-112946 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2026-112946" }, "action_statement": "Vulnerability CVE-2026-112946 affects version 5.4.12 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-04T02:56:20.215700+00:00", "status_notes": "Vulnerability CVE-2026-112947 does not affect version 5.4.12 of vite. not_affected \u2014 Target Vite v5.4.12-tuxcare is NOT AFFECTED by CVE-2026-112947. The vulnerability exists in code that handles the `?vite-wasm-instance` query parameter, which was introduced in commit c23d85b96 on 2026-06-11, nearly 5 months AFTER the target version was released (2025-01-20). This vulnerable feature (direct .wasm imports / WASM ESM Integration) first appears in Vite v8.1.0+. The target version ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112947" }, "impact_statement": "not_affected \u2014 Target Vite v5.4.12-tuxcare is NOT AFFECTED by CVE-2026-112947. The vulnerability exists in code that handles the `?vite-wasm-instance` query parameter, which was introduced in commit c23d85b96 on 2026-06-11, nearly 5 months AFTER the target version was released (2025-01-20). This vulnerable feature (direct .wasm imports / WASM ESM Integration) first appears in Vite v8.1.0+. The target version ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-03T20:51:20.505787+00:00", "status_notes": "Vulnerability CVE-2026-118662 does not affect version 5.4.12 of vite. not_affected \u2014 CVE-2026-118662 describes a server.fs.deny bypass in Vite dev server when query parameters (?raw, ?import&raw, ?import&url&inline) are used. The vulnerability pattern is NOT present in v5.4.12 because the fix (PR #18112, commit 6820bb3b9) was already included in the upstream release v5.4.6. The fix adds ensureServingAccess checks in transform middleware that strip query parameters before valida...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-118662" }, "impact_statement": "not_affected \u2014 CVE-2026-118662 describes a server.fs.deny bypass in Vite dev server when query parameters (?raw, ?import&raw, ?import&url&inline) are used. The vulnerability pattern is NOT present in v5.4.12 because the fix (PR #18112, commit 6820bb3b9) was already included in the upstream release v5.4.6. The fix adds ensureServingAccess checks in transform middleware that strip query parameters before valida..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-30T14:48:00.154664+00:00", "status_notes": "Vulnerability CVE-2026-39363 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2026-39363" }, "action_statement": "Vulnerability CVE-2026-39363 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-30T14:48:00.154664+00:00", "status_notes": "Vulnerability CVE-2026-39364 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2026-39364" }, "action_statement": "Vulnerability CVE-2026-39364 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2026-39365 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2026-39365" }, "action_statement": "Vulnerability CVE-2026-39365 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2026-53571 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2026-53571" }, "action_statement": "Vulnerability CVE-2026-53571 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2026-53632 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2026-53632" }, "action_statement": "Vulnerability CVE-2026-53632 affects version 5.4.12 of vite." } ] }