{
  "@id": "urn:uuid:9856b775-ed22-4db8-b67f-c295e6205590",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 25,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T11:41:00.041305+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-04T04:52:00.041416+00:00",
      "status_notes": "Vulnerability CVE-2022-35204 affects version 6.4.4 of vite.",
      "vulnerability": {
        "name": "CVE-2022-35204"
      },
      "action_statement": "Vulnerability CVE-2022-35204 affects version 6.4.4 of vite."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-04T04:52:00.041416+00:00",
      "status_notes": "Vulnerability CVE-2023-34092 affects version 6.4.4 of vite.",
      "vulnerability": {
        "name": "CVE-2023-34092"
      },
      "action_statement": "Vulnerability CVE-2023-34092 affects version 6.4.4 of vite."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-04T04:52:00.041416+00:00",
      "status_notes": "Vulnerability CVE-2023-49293 affects version 6.4.4 of vite.",
      "vulnerability": {
        "name": "CVE-2023-49293"
      },
      "action_statement": "Vulnerability CVE-2023-49293 affects version 6.4.4 of vite."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-10-30T14:25:00.217895+00:00",
      "status_notes": "Vulnerability CVE-2024-23331 affects version 6.4.4 of vite.",
      "vulnerability": {
        "name": "CVE-2024-23331"
      },
      "action_statement": "Vulnerability CVE-2024-23331 affects version 6.4.4 of vite."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-03T23:50:00.091479+00:00",
      "status_notes": "Vulnerability CVE-2024-31207 does not affect version 6.4.4 of vite. not_affected \u2014 The target (Vite v6.4.4) is NOT AFFECTED by CVE-2024-31207. The vulnerability pattern (using picomatch with `matchBase: true` without `dot: true` and without pattern transformation) is not present in the target code. The fix was already included in the upstream Vite v6.4.4 release before TuxCare onboarded it. The fix changes picomatch configuration to use `matchBase: false`, adds `dot: true` fo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-31207"
      },
      "impact_statement": "not_affected \u2014 The target (Vite v6.4.4) is NOT AFFECTED by CVE-2024-31207. The vulnerability pattern (using picomatch with `matchBase: true` without `dot: true` and without pattern transformation) is not present in the target code. The fix was already included in the upstream Vite v6.4.4 release before TuxCare onboarded it. The fix changes picomatch configuration to use `matchBase: false`, adds `dot: true` fo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-03T23:54:00.050974+00:00",
      "status_notes": "Vulnerability CVE-2024-45811 does not affect version 6.4.4 of vite. not_affected \u2014 CVE-2024-45811 is not present in Vite 6.4.4. The vulnerability allowed bypassing `@fs` access restrictions by adding `?import&raw` query parameters to URLs. The fix (commit 9d2413c8b by upstream developer patak-dev, PR #18112) was already included in the upstream Vite v6.4.4 release before TuxCare onboarded it. The target implements the defense via `isServerAccessDeniedForTransform` (transform....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-45811"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-45811 is not present in Vite 6.4.4. The vulnerability allowed bypassing `@fs` access restrictions by adding `?import&raw` query parameters to URLs. The fix (commit 9d2413c8b by upstream developer patak-dev, PR #18112) was already included in the upstream Vite v6.4.4 release before TuxCare onboarded it. The target implements the defense via `isServerAccessDeniedForTransform` (transform...."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-04T04:52:00.041416+00:00",
      "status_notes": "Vulnerability CVE-2024-45812 affects version 6.4.4 of vite.",
      "vulnerability": {
        "name": "CVE-2024-45812"
      },
      "action_statement": "Vulnerability CVE-2024-45812 affects version 6.4.4 of vite."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-04T04:52:00.041416+00:00",
      "status_notes": "Vulnerability CVE-2024-52011 affects version 6.4.4 of vite.",
      "vulnerability": {
        "name": "CVE-2024-52011"
      },
      "action_statement": "Vulnerability CVE-2024-52011 affects version 6.4.4 of vite."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-03T23:59:44.966298+00:00",
      "status_notes": "Vulnerability CVE-2025-24010 does not affect version 6.4.4 of vite. not_affected \u2014 The target repository at v6.4.4 (SHA 03d7b47f0) is NOT AFFECTED by CVE-2025-24010. All three security fixes addressing the vulnerability were authored by upstream Vite developer sapphi-red and shipped in upstream releases v6.0.9-v6.0.11, well before v6.4.4. The fixes implement: (1) CORS restriction to loopback origins only via defaultAllowedOrigins regex, (2) WebSocket token validation to preve...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-24010"
      },
      "impact_statement": "not_affected \u2014 The target repository at v6.4.4 (SHA 03d7b47f0) is NOT AFFECTED by CVE-2025-24010. All three security fixes addressing the vulnerability were authored by upstream Vite developer sapphi-red and shipped in upstream releases v6.0.9-v6.0.11, well before v6.4.4. The fixes implement: (1) CORS restriction to loopback origins only via defaultAllowedOrigins regex, (2) WebSocket token validation to preve..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-06T11:27:17.797774+00:00",
      "status_notes": "Vulnerability CVE-2025-30208 does not affect version 6.4.4 of vite. not_affected \u2014 Vite 6.4.4 is not affected by CVE-2025-30208. The access check on the transform path now uses query regexes that tolerate trailing separators, and the check runs on the resolved id. A request like /@fs/tmp/secret.txt?import&raw?? is therefore denied. The fix was shipped upstream and HEAD has no TuxCare-domain commits.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-30208"
      },
      "impact_statement": "not_affected \u2014 Vite 6.4.4 is not affected by CVE-2025-30208. The access check on the transform path now uses query regexes that tolerate trailing separators, and the check runs on the resolved id. A request like /@fs/tmp/secret.txt?import&raw?? is therefore denied. The fix was shipped upstream and HEAD has no TuxCare-domain commits."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-06T11:31:00.029474+00:00",
      "status_notes": "Vulnerability CVE-2025-31125 does not affect version 6.4.4 of vite. not_affected \u2014 Vite 6.4.4 already contains the upstream fix for CVE-2025-31125. Commit 59673137c (\"fix: fs check in transform middleware (#19761)\") is an ancestor of HEAD and was written by upstream maintainer patak-dev. HEAD's history has no TuxCare-domain commits, so this is an upstream fix shipped in the release, not a TuxCare backport. The transform pipeline now applies the server.fs allow/deny check to i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31125"
      },
      "impact_statement": "not_affected \u2014 Vite 6.4.4 already contains the upstream fix for CVE-2025-31125. Commit 59673137c (\"fix: fs check in transform middleware (#19761)\") is an ancestor of HEAD and was written by upstream maintainer patak-dev. HEAD's history has no TuxCare-domain commits, so this is an upstream fix shipped in the release, not a TuxCare backport. The transform pipeline now applies the server.fs allow/deny check to i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-06T11:32:00.041448+00:00",
      "status_notes": "Vulnerability CVE-2025-31486 does not affect version 6.4.4 of vite. not_affected \u2014 Vite 6.4.4 already contains the upstream fix for CVE-2025-31486 (commit 62d7e81ee, \"fix: fs check with svg and relative paths (#19782)\"). It shipped in the upstream release, before the first TuxCare commit. The fs.deny/fs.allow check now runs in loadAndTransform on the resolved, normalized id, and it covers svg, raw, url and inline requests.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-31486"
      },
      "impact_statement": "not_affected \u2014 Vite 6.4.4 already contains the upstream fix for CVE-2025-31486 (commit 62d7e81ee, \"fix: fs check with svg and relative paths (#19782)\"). It shipped in the upstream release, before the first TuxCare commit. The fs.deny/fs.allow check now runs in loadAndTransform on the resolved, normalized id, and it covers svg, raw, url and inline requests."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-06T11:39:00.034682+00:00",
      "status_notes": "Vulnerability CVE-2025-32395 does not affect version 6.4.4 of vite. not_affected \u2014 Vite 6.4.4 already contains the upstream fix for CVE-2025-32395. The `rejectInvalidRequestMiddleware` rejects any request whose req.url contains '#' with a 400. It is registered before the other internal middlewares, including the static and fs-serving ones. The fix came from upstream commit 175a8390 (author green@sapphi.red), which is in the upstream release. HEAD has no TuxCare-domain commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-32395"
      },
      "impact_statement": "not_affected \u2014 Vite 6.4.4 already contains the upstream fix for CVE-2025-32395. The `rejectInvalidRequestMiddleware` rejects any request whose req.url contains '#' with a 400. It is registered before the other internal middlewares, including the static and fs-serving ones. The fix came from upstream commit 175a8390 (author green@sapphi.red), which is in the upstream release. HEAD has no TuxCare-domain commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-04T00:06:39.588556+00:00",
      "status_notes": "Vulnerability CVE-2025-46565 does not affect version 6.4.4 of vite. not_affected \u2014 CVE-2025-46565 is NOT present in Vite 6.4.4. The vulnerability allowed bypassing server.fs.deny patterns via path manipulation (e.g., /.env/.), but the upstream fix (commit c22c43de612eebb6c182dd67850c24e4fab8cacb by green@sapphi.red) shipped in the Vite 6.4.4 release. The fix adds shouldServe callback in sirv that validates resolved file paths against deny patterns after path normalization, bl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-46565"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-46565 is NOT present in Vite 6.4.4. The vulnerability allowed bypassing server.fs.deny patterns via path manipulation (e.g., /.env/.), but the upstream fix (commit c22c43de612eebb6c182dd67850c24e4fab8cacb by green@sapphi.red) shipped in the Vite 6.4.4 release. The fix adds shouldServe callback in sirv that validates resolved file paths against deny patterns after path normalization, bl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-04T00:14:33.349796+00:00",
      "status_notes": "Vulnerability CVE-2025-58751 does not affect version 6.4.4 of vite. not_affected \u2014 Vite v6.4.4 is NOT affected by CVE-2025-58751. The vulnerability (path traversal via partial directory name prefix matching in sirv's boundary check) was fixed in upstream commits e11d24008 (sirv 3.0.2 upgrade) and 0ab19ea9f (HTML fs.strict check), both authored by upstream developer green@sapphi.red and shipped in the v6.4.4 release before TuxCare's onboarding. The fix ensures sirv's directory...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-58751"
      },
      "impact_statement": "not_affected \u2014 Vite v6.4.4 is NOT affected by CVE-2025-58751. The vulnerability (path traversal via partial directory name prefix matching in sirv's boundary check) was fixed in upstream commits e11d24008 (sirv 3.0.2 upgrade) and 0ab19ea9f (HTML fs.strict check), both authored by upstream developer green@sapphi.red and shipped in the v6.4.4 release before TuxCare's onboarding. The fix ensures sirv's directory..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-04T00:18:30.099191+00:00",
      "status_notes": "Vulnerability CVE-2025-58752 does not affect version 6.4.4 of vite. not_affected \u2014 The target Vite v6.4.4 is not affected by CVE-2025-58752. The upstream fix that adds server.fs access control checks to HTML file serving was already present in the upstream release v6.4.4 that TuxCare onboarded. The vulnerable pattern (serving HTML files without checking server.fs allow/deny rules) is not present in the target code.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-58752"
      },
      "impact_statement": "not_affected \u2014 The target Vite v6.4.4 is not affected by CVE-2025-58752. The upstream fix that adds server.fs access control checks to HTML file serving was already present in the upstream release v6.4.4 that TuxCare onboarded. The vulnerable pattern (serving HTML files without checking server.fs allow/deny rules) is not present in the target code."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-04T00:25:27.063855+00:00",
      "status_notes": "Vulnerability CVE-2025-62522 does not affect version 6.4.4 of vite. not_affected \u2014 The target repository (Vite v6.4.4) is NOT AFFECTED by CVE-2025-62522. The vulnerability, which allowed bypassing server.fs.deny restrictions using URLs ending with backslash (\\) on Windows, has been fixed in the upstream release. The fix (commit 1114b5d7ea03e26572708715343bec69db4536e8, authored by green@sapphi.red, committed Oct 20, 2025) was already present in the upstream v6.4.4 release (Oc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-62522"
      },
      "impact_statement": "not_affected \u2014 The target repository (Vite v6.4.4) is NOT AFFECTED by CVE-2025-62522. The vulnerability, which allowed bypassing server.fs.deny restrictions using URLs ending with backslash (\\) on Windows, has been fixed in the upstream release. The fix (commit 1114b5d7ea03e26572708715343bec69db4536e8, authored by green@sapphi.red, committed Oct 20, 2025) was already present in the upstream v6.4.4 release (Oc..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-10-31T13:23:15.764405+00:00",
      "status_notes": "Vulnerability CVE-2026-112942 affects version 6.4.4 of vite.",
      "vulnerability": {
        "name": "CVE-2026-112942"
      },
      "action_statement": "Vulnerability CVE-2026-112942 affects version 6.4.4 of vite."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-04T02:51:00.042669+00:00",
      "status_notes": "Vulnerability CVE-2026-112943 does not affect version 6.4.4 of vite. not_affected \u2014 Vite 6.4.4 is not affected by CVE-2026-112943. The vulnerability concerns insufficient escaping of `%` characters in launch-editor when passing arguments to cmd.exe on Windows. Vite bundles launch-editor-middleware as a dependency, but the current version (2.14.2) already contains the fix. The update from 2.14.1 to 2.14.2 was performed by upstream commit 8afec69d6, which is part of the upstream...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-112943"
      },
      "impact_statement": "not_affected \u2014 Vite 6.4.4 is not affected by CVE-2026-112943. The vulnerability concerns insufficient escaping of `%` characters in launch-editor when passing arguments to cmd.exe on Windows. Vite bundles launch-editor-middleware as a dependency, but the current version (2.14.2) already contains the fix. The update from 2.14.1 to 2.14.2 was performed by upstream commit 8afec69d6, which is part of the upstream..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-04T02:52:11.477173+00:00",
      "status_notes": "Vulnerability CVE-2026-112944 does not affect version 6.4.4 of vite. not_affected \u2014 Vite 6.4.4 is not affected by CVE-2026-112944. The vulnerability concerns file paths starting with `-` or `+` being interpreted as CLI flags when passed to editors, potentially causing command execution. The upstream fix (commit 8afec69d6) updated launch-editor-middleware from 2.14.1 to 2.14.2, which addresses CVE-2026-112944 by adding proper path sanitization and escaping. This fix was authore...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-112944"
      },
      "impact_statement": "not_affected \u2014 Vite 6.4.4 is not affected by CVE-2026-112944. The vulnerability concerns file paths starting with `-` or `+` being interpreted as CLI flags when passed to editors, potentially causing command execution. The upstream fix (commit 8afec69d6) updated launch-editor-middleware from 2.14.1 to 2.14.2, which addresses CVE-2026-112944 by adding proper path sanitization and escaping. This fix was authore..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-04T02:51:00.042669+00:00",
      "status_notes": "Vulnerability CVE-2026-112945 does not affect version 6.4.4 of vite. not_affected \u2014 The target (Vite 6.4.4 at SHA 03d7b47f0) is NOT AFFECTED by CVE-2026-112945. The vulnerability allowed XSS via protocol-relative URLs with path traversal in query parameters (e.g., `//evil.example/payload.js?/../../package.json`). The upstream fix (commit 19902cfcf by green@sapphi.red) shipped in v6.4.4 and is present in HEAD. Both required defenses are implemented: (1) cleanUrl() strips query ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-112945"
      },
      "impact_statement": "not_affected \u2014 The target (Vite 6.4.4 at SHA 03d7b47f0) is NOT AFFECTED by CVE-2026-112945. The vulnerability allowed XSS via protocol-relative URLs with path traversal in query parameters (e.g., `//evil.example/payload.js?/../../package.json`). The upstream fix (commit 19902cfcf by green@sapphi.red) shipped in v6.4.4 and is present in HEAD. Both required defenses are implemented: (1) cleanUrl() strips query ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-04T02:52:42.196689+00:00",
      "status_notes": "Vulnerability CVE-2026-112946 does not affect version 6.4.4 of vite. not_affected \u2014 The target repository (Vite 6.4.4 at SHA 03d7b47f0) already contains the fix for CVE-2026-112946. The vulnerability allowed path traversal by confusing project-relative URLs (e.g., `/etc/hostname`) with absolute filesystem paths when storing entries in `safeModulePaths`. The fix commit e570d8d016096b5f8f6f09808376ca6cf73f27d0 changes `packages/vite/src/node/plugins/importAnalysis.ts` to store r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-112946"
      },
      "impact_statement": "not_affected \u2014 The target repository (Vite 6.4.4 at SHA 03d7b47f0) already contains the fix for CVE-2026-112946. The vulnerability allowed path traversal by confusing project-relative URLs (e.g., `/etc/hostname`) with absolute filesystem paths when storing entries in `safeModulePaths`. The fix commit e570d8d016096b5f8f6f09808376ca6cf73f27d0 changes `packages/vite/src/node/plugins/importAnalysis.ts` to store r..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-04T03:00:00.493294+00:00",
      "status_notes": "Vulnerability CVE-2026-112947 does not affect version 6.4.4 of vite. not_affected \u2014 The target version (Vite 6.4.4) does not contain the vulnerability because the `?vite-wasm-instance` query parameter handling code does not exist in this version. The vulnerable feature was introduced in Vite 8.1.0+ (commit 9e79b515, July 16, 2026), which is after the target's v6.4.4 release (October 6, 2026). Without the code to process `?vite-wasm-instance` queries, the attack vector describe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-112947"
      },
      "impact_statement": "not_affected \u2014 The target version (Vite 6.4.4) does not contain the vulnerability because the `?vite-wasm-instance` query parameter handling code does not exist in this version. The vulnerable feature was introduced in Vite 8.1.0+ (commit 9e79b515, July 16, 2026), which is after the target's v6.4.4 release (October 6, 2026). Without the code to process `?vite-wasm-instance` queries, the attack vector describe..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-10-29T16:43:07.038556+00:00",
      "status_notes": "Vulnerability CVE-2026-118662 affects version 6.4.4 of vite.",
      "vulnerability": {
        "name": "CVE-2026-118662"
      },
      "action_statement": "Vulnerability CVE-2026-118662 affects version 6.4.4 of vite."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-10-30T14:48:00.154664+00:00",
      "status_notes": "Vulnerability CVE-2026-39363 affects version 6.4.4 of vite.",
      "vulnerability": {
        "name": "CVE-2026-39363"
      },
      "action_statement": "Vulnerability CVE-2026-39363 affects version 6.4.4 of vite."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-10-30T14:48:00.154664+00:00",
      "status_notes": "Vulnerability CVE-2026-39364 affects version 6.4.4 of vite.",
      "vulnerability": {
        "name": "CVE-2026-39364"
      },
      "action_statement": "Vulnerability CVE-2026-39364 affects version 6.4.4 of vite."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-06T11:41:00.041305+00:00",
      "status_notes": "Vulnerability CVE-2026-39365 does not affect version 6.4.4 of vite. not_affected \u2014 Not affected. The target (Vite 6.4.4) already contains the upstream fix for the optimized-deps .map path traversal. transform.ts resolves the URL to an absolute path and rejects it unless it lies under the deps cache directory. The fix is upstream commit ca4da5d1 (sapphi-red), which is inside the v6.4.4 release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-39365"
      },
      "impact_statement": "not_affected \u2014 Not affected. The target (Vite 6.4.4) already contains the upstream fix for the optimized-deps .map path traversal. transform.ts resolves the URL to an absolute path and rejects it unless it lies under the deps cache directory. The fix is upstream commit ca4da5d1 (sapphi-red), which is inside the v6.4.4 release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-10-31T13:22:29.205538+00:00",
      "status_notes": "Vulnerability CVE-2026-53571 affects version 6.4.4 of vite.",
      "vulnerability": {
        "name": "CVE-2026-53571"
      },
      "action_statement": "Vulnerability CVE-2026-53571 affects version 6.4.4 of vite."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@6.4.4",
          "identifiers": {
            "purl": "pkg:npm/vite@6.4.4"
          }
        }
      ],
      "timestamp": "2026-11-04T02:50:04.890115+00:00",
      "status_notes": "Vulnerability CVE-2026-53632 does not affect version 6.4.4 of vite. not_affected \u2014 CVE-2026-53632 (UNC path NTLM hash disclosure) is NOT present in Vite 6.4.4. The vulnerability was fixed by the upstream Vite project in version 6.4.2 by updating launch-editor-middleware from 2.10.0 to 2.14.1, which incorporated the fix from launch-editor@2.14.1 that rejects Windows UNC paths before filesystem operations. The target is at version 6.4.4 with launch-editor-middleware@2.14.2, whi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-53632"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-53632 (UNC path NTLM hash disclosure) is NOT present in Vite 6.4.4. The vulnerability was fixed by the upstream Vite project in version 6.4.2 by updating launch-editor-middleware from 2.10.0 to 2.14.1, which incorporated the fix from launch-editor@2.14.1 that rejects Windows UNC paths before filesystem operations. The target is at version 6.4.4 with launch-editor-middleware@2.14.2, whi..."
    }
  ]
}