{ "@id": "urn:uuid:9fdcde29-c418-4668-ba08-271a3a2c6579", "role": "Document Creator", "author": "https://tuxcare.com", "version": 19, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T11:37:00.035304+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 6.4.2 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 6.4.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 6.4.2 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 6.4.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-49293 affects version 6.4.2 of vite.", "vulnerability": { "name": "CVE-2023-49293" }, "action_statement": "Vulnerability CVE-2023-49293 affects version 6.4.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-23331 affects version 6.4.2 of vite.", "vulnerability": { "name": "CVE-2024-23331" }, "action_statement": "Vulnerability CVE-2024-23331 affects version 6.4.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-11-03T23:46:00.069586+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 6.4.2 of vite. not_affected \u2014 CVE-2024-31207 is not present in Vite 6.4.2. The vulnerability involved incorrect picomatch configuration (matchBase: true) that prevented fs.deny patterns with directories and dotfiles from working properly. The fix (commit ba5269cca) was applied by the upstream Vite project in v5.2.6 (March 2024) and shipped in the upstream release that TuxCare later onboarded. The current code in packages/vi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "not_affected \u2014 CVE-2024-31207 is not present in Vite 6.4.2. The vulnerability involved incorrect picomatch configuration (matchBase: true) that prevented fs.deny patterns with directories and dotfiles from working properly. The fix (commit ba5269cca) was applied by the upstream Vite project in v5.2.6 (March 2024) and shipped in the upstream release that TuxCare later onboarded. The current code in packages/vi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-11-03T23:52:00.070015+00:00", "status_notes": "Vulnerability CVE-2024-45811 does not affect version 6.4.2 of vite. not_affected \u2014 Vite 6.4.2 is not affected by CVE-2024-45811. The upstream fix (commit 9d2413c8b by patak-dev, PR #18112) shipped in the Vite 6.4.2 release before TuxCare onboarding. The vulnerable code pattern - unprotected processing of ?raw and ?url query parameters in the transform middleware - is not present in this version. The defense checks access permissions via checkServingAccess() before processing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45811" }, "impact_statement": "not_affected \u2014 Vite 6.4.2 is not affected by CVE-2024-45811. The upstream fix (commit 9d2413c8b by patak-dev, PR #18112) shipped in the Vite 6.4.2 release before TuxCare onboarding. The vulnerable code pattern - unprotected processing of ?raw and ?url query parameters in the transform middleware - is not present in this version. The defense checks access permissions via checkServingAccess() before processing ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-45812 affects version 6.4.2 of vite.", "vulnerability": { "name": "CVE-2024-45812" }, "action_statement": "Vulnerability CVE-2024-45812 affects version 6.4.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-52011 affects version 6.4.2 of vite.", "vulnerability": { "name": "CVE-2024-52011" }, "action_statement": "Vulnerability CVE-2024-52011 affects version 6.4.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-11-03T23:54:38.992365+00:00", "status_notes": "Vulnerability CVE-2025-24010 does not affect version 6.4.2 of vite. not_affected \u2014 Target Vite v6.4.2 is not affected by CVE-2025-24010. All three upstream security fixes (WebSocket token verification, CORS default to false, Host header validation) were released in Vite v6.0.9 (2025-01-20) and are already present in the v6.4.2 release. The vulnerable code patterns described in the CVE (permissive CORS, missing WebSocket Origin validation, missing Host header validation) do no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24010" }, "impact_statement": "not_affected \u2014 Target Vite v6.4.2 is not affected by CVE-2025-24010. All three upstream security fixes (WebSocket token verification, CORS default to false, Host header validation) were released in Vite v6.0.9 (2025-01-20) and are already present in the v6.4.2 release. The vulnerable code patterns described in the CVE (permissive CORS, missing WebSocket Origin validation, missing Host header validation) do no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-11-06T11:26:42.233420+00:00", "status_notes": "Vulnerability CVE-2025-30208 does not affect version 6.4.2 of vite. not_affected \u2014 Target vite 6.4.2 (tuxcare.6) already contains the upstream fix for CVE-2025-30208 (#19702, commit 262b5ec7a). That commit is part of the upstream release TuxCare onboarded, so the verdict is not_affected (upstream fix), not already_fixed. The transform middleware strips trailing query separators before running the raw/url/inline serving-access check, so `?raw??` and `?import&raw??` no longer b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-30208" }, "impact_statement": "not_affected \u2014 Target vite 6.4.2 (tuxcare.6) already contains the upstream fix for CVE-2025-30208 (#19702, commit 262b5ec7a). That commit is part of the upstream release TuxCare onboarded, so the verdict is not_affected (upstream fix), not already_fixed. The transform middleware strips trailing query separators before running the raw/url/inline serving-access check, so `?raw??` and `?import&raw??` no longer b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-11-06T11:28:00.026983+00:00", "status_notes": "Vulnerability CVE-2025-31125 does not affect version 6.4.2 of vite. not_affected \u2014 Target (vite 6.4.2-tuxcare.6) already contains the upstream fix for CVE-2025-31125. The transform middleware applies the fs allow/deny check to URLs with raw/url/inline query markers after stripping trailing query separators. The fix commit 59673137 (#19761) is in the upstream 6.4.2 release, before any TuxCare commit, so this is an upstream fix and the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31125" }, "impact_statement": "not_affected \u2014 Target (vite 6.4.2-tuxcare.6) already contains the upstream fix for CVE-2025-31125. The transform middleware applies the fs allow/deny check to URLs with raw/url/inline query markers after stripping trailing query separators. The fix commit 59673137 (#19761) is in the upstream 6.4.2 release, before any TuxCare commit, so this is an upstream fix and the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-11-06T11:30:06.317055+00:00", "status_notes": "Vulnerability CVE-2025-31486 does not affect version 6.4.2 of vite. not_affected \u2014 The upstream fix for CVE-2025-31486 (vitejs/vite 62d7e81ee, \"fix: fs check with svg and relative paths (#19782)\") is already in HEAD. It shipped in the upstream release that TuxCare onboarded, so the vulnerable pattern is absent. The fs allow-list check now runs in loadAndTransform on the normalized id. It also covers ids matching the svg pattern, so the `?.svg?.wasm?init` and relative-path byp...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31486" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2025-31486 (vitejs/vite 62d7e81ee, \"fix: fs check with svg and relative paths (#19782)\") is already in HEAD. It shipped in the upstream release that TuxCare onboarded, so the vulnerable pattern is absent. The fs allow-list check now runs in loadAndTransform on the normalized id. It also covers ids matching the svg pattern, so the `?.svg?.wasm?init` and relative-path byp..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-11-06T11:37:00.035304+00:00", "status_notes": "Vulnerability CVE-2025-32395 does not affect version 6.4.2 of vite. not_affected \u2014 Vite 6.4.2 already contains the upstream fix for CVE-2025-32395. The first middleware in the dev server stack (rejectInvalidRequestMiddleware) returns 400 for any req.url containing '#', so the fs.deny bypass cannot occur. The fix is upstream-authored (green@sapphi.red, commit 175a8390, PR #19830) and is part of the upstream release TuxCare onboarded, so the verdict is not_affected, not already...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32395" }, "impact_statement": "not_affected \u2014 Vite 6.4.2 already contains the upstream fix for CVE-2025-32395. The first middleware in the dev server stack (rejectInvalidRequestMiddleware) returns 400 for any req.url containing '#', so the fs.deny bypass cannot occur. The fix is upstream-authored (green@sapphi.red, commit 175a8390, PR #19830) and is part of the upstream release TuxCare onboarded, so the verdict is not_affected, not already..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-11-03T23:57:41.357195+00:00", "status_notes": "Vulnerability CVE-2025-46565 does not affect version 6.4.2 of vite. not_affected \u2014 The target Vite 6.4.2 is not affected by CVE-2025-46565. The fix for this vulnerability (validating file paths at serving time via sirv's shouldServe callback) was already present in the upstream Vite 6.4.2 release that TuxCare onboarded. The vulnerable pattern (pre-validating request URLs before path resolution, allowing /.env/. bypass) is not present in the target codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46565" }, "impact_statement": "not_affected \u2014 The target Vite 6.4.2 is not affected by CVE-2025-46565. The fix for this vulnerability (validating file paths at serving time via sirv's shouldServe callback) was already present in the upstream Vite 6.4.2 release that TuxCare onboarded. The vulnerable pattern (pre-validating request URLs before path resolution, allowing /.env/. bypass) is not present in the target codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58751 does not affect version 6.4.2 of vite. not_affected \u2014 The target repository (Vite 6.4.2 at SHA b3673ed76) is NOT affected by CVE-2025-58751. The vulnerability pattern is not present because the upstream Vite vendor already applied the fix in commits e11d24008 (sirv 3.0.2 upgrade) and c22c43de6 (shouldServe integration), both authored by sapphi-red. These commits prevent the path traversal attack by ensuring directory paths end with a separator bef...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58751" }, "impact_statement": "not_affected \u2014 The target repository (Vite 6.4.2 at SHA b3673ed76) is NOT affected by CVE-2025-58751. The vulnerability pattern is not present because the upstream Vite vendor already applied the fix in commits e11d24008 (sirv 3.0.2 upgrade) and c22c43de6 (shouldServe integration), both authored by sapphi-red. These commits prevent the path traversal attack by ensuring directory paths end with a separator bef..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58752 does not affect version 6.4.2 of vite. not_affected \u2014 CVE-2025-58752 affects Vite's HTML file serving and sourcemap handling, allowing path traversal to read arbitrary files outside configured root directories. The target repository (Vite 6.4.2) contains fixes for both vulnerabilities, applied by upstream vendor commits 0ab19ea9f (HTML files) and ca4da5d1f (sourcemaps). Both commits are authored by green@sapphi.red, an upstream Vite maintainer, no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58752" }, "impact_statement": "not_affected \u2014 CVE-2025-58752 affects Vite's HTML file serving and sourcemap handling, allowing path traversal to read arbitrary files outside configured root directories. The target repository (Vite 6.4.2) contains fixes for both vulnerabilities, applied by upstream vendor commits 0ab19ea9f (HTML files) and ca4da5d1f (sourcemaps). Both commits are authored by green@sapphi.red, an upstream Vite maintainer, no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62522 does not affect version 6.4.2 of vite. not_affected \u2014 CVE-2025-62522 has been fixed in the target version 6.4.2. The upstream vendor fix from vitejs/vite v6.4.1 (commit 1114b5d7e) is present, which strips trailing slashes from file paths before checking against server.fs.deny patterns. The vulnerable code pattern where URLs ending with \\ or / could bypass deny-list checks no longer exists.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62522" }, "impact_statement": "not_affected \u2014 CVE-2025-62522 has been fixed in the target version 6.4.2. The upstream vendor fix from vitejs/vite v6.4.1 (commit 1114b5d7e) is present, which strips trailing slashes from file paths before checking against server.fs.deny patterns. The vulnerable code pattern where URLs ending with \\ or / could bypass deny-list checks no longer exists." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-10-20T19:57:00.094462+00:00", "status_notes": "Vulnerability CVE-2026-112942 affects version 6.4.2 of vite.", "vulnerability": { "name": "CVE-2026-112942" }, "action_statement": "Vulnerability CVE-2026-112942 affects version 6.4.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-10-23T16:26:00.069942+00:00", "status_notes": "Vulnerability CVE-2026-112943 does not affect version 6.4.2 of vite. not_affected \u2014 CVE-2026-112943 describes unescaped `%` in launch-editor on Windows, allowing command injection via environment variable expansion. However, the target (Vite 6.4.2-tuxcare.5) uses launch-editor-middleware 2.14.1, which depends on launch-editor 2.14.1. Historical evidence shows that launch-editor 2.9.0 added cmd.exe metacharacter escaping including `%` (vitejs/launch-editor@971291e, fixing CVE-2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112943" }, "impact_statement": "not_affected \u2014 CVE-2026-112943 describes unescaped `%` in launch-editor on Windows, allowing command injection via environment variable expansion. However, the target (Vite 6.4.2-tuxcare.5) uses launch-editor-middleware 2.14.1, which depends on launch-editor 2.14.1. Historical evidence shows that launch-editor 2.9.0 added cmd.exe metacharacter escaping including `%` (vitejs/launch-editor@971291e, fixing CVE-2..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-10-20T19:57:00.094462+00:00", "status_notes": "Vulnerability CVE-2026-112944 affects version 6.4.2 of vite.", "vulnerability": { "name": "CVE-2026-112944" }, "action_statement": "Vulnerability CVE-2026-112944 affects version 6.4.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2026-112945 affects version 6.4.2 of vite, and is fixed in 6.4.2-tuxcare.6.", "vulnerability": { "name": "CVE-2026-112945" }, "action_statement": "Vulnerability CVE-2026-112945 affects version 6.4.2 of vite, and is fixed in 6.4.2-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2026-112946 affects version 6.4.2 of vite, and is fixed in 6.4.2-tuxcare.6.", "vulnerability": { "name": "CVE-2026-112946" }, "action_statement": "Vulnerability CVE-2026-112946 affects version 6.4.2 of vite, and is fixed in 6.4.2-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-10-31T13:23:15.764405+00:00", "status_notes": "Vulnerability CVE-2026-112947 affects version 6.4.2 of vite.", "vulnerability": { "name": "CVE-2026-112947" }, "action_statement": "Vulnerability CVE-2026-112947 affects version 6.4.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-10-29T16:45:45.459074+00:00", "status_notes": "Vulnerability CVE-2026-118662 affects version 6.4.2 of vite.", "vulnerability": { "name": "CVE-2026-118662" }, "action_statement": "Vulnerability CVE-2026-118662 affects version 6.4.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39363 does not affect version 6.4.2 of vite. The target is not affected by CVE-2026-39363. The vulnerability allowed attackers to read arbitrary server files via WebSocket by invoking fetchModule without server.fs access control checks. An upstream vendor fix (commit fe28e47e9) has already been applied in the target repository, which completely disables fetchModule for the client environment exposed via WebSocket, throwing an error when invoked. The vulnerable pattern (unprotected fetchModule accessible via network WebSocket) is no longer present in the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39363" }, "impact_statement": "The target is not affected by CVE-2026-39363. The vulnerability allowed attackers to read arbitrary server files via WebSocket by invoking fetchModule without server.fs access control checks. An upstream vendor fix (commit fe28e47e9) has already been applied in the target repository, which completely disables fetchModule for the client environment exposed via WebSocket, throwing an error when invoked. The vulnerable pattern (unprotected fetchModule accessible via network WebSocket) is no longer present in the target code." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39364 does not affect version 6.4.2 of vite. Version 6.4.2 is not affected by CVE-2026-39364. The vulnerability was introduced in v7.1.0 when the protective `deniedServingAccessForTransform()` function was removed during an architectural refactoring. Version 6.4.2 uses a different code architecture that includes this defensive function, which checks file access against deny patterns using the cleaned URL (query parameters stripped) before the potentially vulnerable `isServerAccessDeniedForTransform()` function is reached. This provides runtime protection that prevents the bypass described in the CVE.", "vulnerability": { "name": "CVE-2026-39364" }, "impact_statement": "Version 6.4.2 is not affected by CVE-2026-39364. The vulnerability was introduced in v7.1.0 when the protective `deniedServingAccessForTransform()` function was removed during an architectural refactoring. Version 6.4.2 uses a different code architecture that includes this defensive function, which checks file access against deny patterns using the cleaned URL (query parameters stripped) before the potentially vulnerable `isServerAccessDeniedForTransform()` function is reached. This provides runtime protection that prevents the bypass described in the CVE." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-10-27T09:58:59.407356+00:00", "status_notes": "Vulnerability CVE-2026-39365 affects version 6.4.2 of vite, and is fixed in 6.4.2-tuxcare.6.", "vulnerability": { "name": "CVE-2026-39365" }, "action_statement": "Vulnerability CVE-2026-39365 affects version 6.4.2 of vite, and is fixed in 6.4.2-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@6.4.2", "identifiers": { "purl": "pkg:npm/vite@6.4.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53571 affects version 6.4.2 of vite, and is fixed in 6.4.2-tuxcare.1.", "vulnerability": { "name": "CVE-2026-53571" }, "action_statement": "Vulnerability CVE-2026-53571 affects version 6.4.2 of vite, and is fixed in 6.4.2-tuxcare.1." } ] }