{ "@id": "urn:uuid:ae766512-6c3f-49bb-b059-a607bf1d281f", "role": "Document Creator", "author": "https://tuxcare.com", "version": 20, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T22:41:00.367522+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 7.3.2-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 7.3.2-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 7.3.2-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 7.3.2-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-49293 affects version 7.3.2-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2023-49293" }, "action_statement": "Vulnerability CVE-2023-49293 affects version 7.3.2-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-23331 affects version 7.3.2-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2024-23331" }, "action_statement": "Vulnerability CVE-2024-23331 affects version 7.3.2-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-03T23:46:00.069586+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 7.3.2-tuxcare.2 of vite. not_affected \u2014 CVE-2024-31207 is not present in Vite 7.3.2-tuxcare.2. The vulnerability involving incorrect picomatch configuration (matchBase: true causing directory-based fs.deny patterns to fail) was fixed in upstream commit ba5269cca by green@sapphi.red. This fix was already included in the upstream release before TuxCare onboarded version 7.3.2, as evidenced by the fix commit being an ancestor of the fir...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "not_affected \u2014 CVE-2024-31207 is not present in Vite 7.3.2-tuxcare.2. The vulnerability involving incorrect picomatch configuration (matchBase: true causing directory-based fs.deny patterns to fail) was fixed in upstream commit ba5269cca by green@sapphi.red. This fix was already included in the upstream release before TuxCare onboarded version 7.3.2, as evidenced by the fix commit being an ancestor of the fir..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-45811 affects version 7.3.2-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2024-45811" }, "action_statement": "Vulnerability CVE-2024-45811 affects version 7.3.2-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-13T22:41:00.367522+00:00", "status_notes": "Vulnerability CVE-2024-45812 does not affect version 7.3.2-tuxcare.2 of vite. not_affected \u2014 Vite 7.3.2 already contains the upstream fix for CVE-2024-45812 (vitejs/vite#18115, commit ade1d89660). getRelativeUrlFromDocument in packages/vite/src/node/build.ts:1312-1319 only trusts document.currentScript.src when its tagName is SCRIPT. Otherwise it falls back to document.baseURI. The fix was authored upstream by thisiszhengyu@gmail.com and was in the upstream release before the first Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45812" }, "impact_statement": "not_affected \u2014 Vite 7.3.2 already contains the upstream fix for CVE-2024-45812 (vitejs/vite#18115, commit ade1d89660). getRelativeUrlFromDocument in packages/vite/src/node/build.ts:1312-1319 only trusts document.currentScript.src when its tagName is SCRIPT. Otherwise it falls back to document.baseURI. The fix was authored upstream by thisiszhengyu@gmail.com and was in the upstream release before the first Tux..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-52011 affects version 7.3.2-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2024-52011" }, "action_statement": "Vulnerability CVE-2024-52011 affects version 7.3.2-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-03T23:56:43.123003+00:00", "status_notes": "Vulnerability CVE-2025-24010 does not affect version 7.3.2-tuxcare.2 of vite. not_affected \u2014 The target version (Vite 7.3.2-tuxcare.2) is NOT vulnerable to CVE-2025-24010. All three security fixes addressing the CVE's attack vectors were shipped in the upstream Vite v7.3.2 release and inherited by the TuxCare build. The fixes include: (1) WebSocket token validation to prevent Cross-Site WebSocket Hijacking, (2) Host header validation to prevent DNS rebinding attacks, and (3) CORS restr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24010" }, "impact_statement": "not_affected \u2014 The target version (Vite 7.3.2-tuxcare.2) is NOT vulnerable to CVE-2025-24010. All three security fixes addressing the CVE's attack vectors were shipped in the upstream Vite v7.3.2 release and inherited by the TuxCare build. The fixes include: (1) WebSocket token validation to prevent Cross-Site WebSocket Hijacking, (2) Host header validation to prevent DNS rebinding attacks, and (3) CORS restr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-06T11:26:00.030618+00:00", "status_notes": "Vulnerability CVE-2025-30208 does not affect version 7.3.2-tuxcare.2 of vite. not_affected \u2014 Vite 7.3.2-tuxcare.2 already contains the upstream fix for CVE-2025-30208. The fs-access check in the transform path uses the lenient regexes /[?&](url|raw|inline)\\b/, which match `?raw??` and `?import&raw??`, so restricted files are denied. The fix shipped in the upstream release that TuxCare onboarded (upstream commit 59673137c, \"fix: fs check in transform middleware (#19761)\", by patak).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-30208" }, "impact_statement": "not_affected \u2014 Vite 7.3.2-tuxcare.2 already contains the upstream fix for CVE-2025-30208. The fs-access check in the transform path uses the lenient regexes /[?&](url|raw|inline)\\b/, which match `?raw??` and `?import&raw??`, so restricted files are denied. The fix shipped in the upstream release that TuxCare onboarded (upstream commit 59673137c, \"fix: fs check in transform middleware (#19761)\", by patak)." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-06T11:27:17.797774+00:00", "status_notes": "Vulnerability CVE-2025-31125 does not affect version 7.3.2-tuxcare.2 of vite. not_affected \u2014 Vite 7.3.2-tuxcare.2 already contains the upstream fix for CVE-2025-31125, commit 59673137 (\"fix: fs check in transform middleware\", #19761). That commit is an ancestor of HEAD and predates the first TuxCare commit, so it shipped in the upstream release. The transform path now applies the server.fs access check to ?raw, ?url, ?inline and .svg requests, using both the cleaned and the raw id. Req...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31125" }, "impact_statement": "not_affected \u2014 Vite 7.3.2-tuxcare.2 already contains the upstream fix for CVE-2025-31125, commit 59673137 (\"fix: fs check in transform middleware\", #19761). That commit is an ancestor of HEAD and predates the first TuxCare commit, so it shipped in the upstream release. The transform path now applies the server.fs access check to ?raw, ?url, ?inline and .svg requests, using both the cleaned and the raw id. Req..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-06T11:30:06.317055+00:00", "status_notes": "Vulnerability CVE-2025-31486 does not affect version 7.3.2-tuxcare.2 of vite. not_affected \u2014 Vite 7.3.2 already contains the upstream fix for CVE-2025-31486 (upstream PR #19782, commit 62d7e81, \"fs check with svg and relative paths\"). The fs deny check runs in transformRequest on the resolved id, and it covers .svg, ?raw, ?url and ?inline requests. The fix shipped in the upstream release before the first TuxCare commit, so the verdict is not_affected. The fix commit's author and commit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31486" }, "impact_statement": "not_affected \u2014 Vite 7.3.2 already contains the upstream fix for CVE-2025-31486 (upstream PR #19782, commit 62d7e81, \"fs check with svg and relative paths\"). The fs deny check runs in transformRequest on the resolved id, and it covers .svg, ?raw, ?url and ?inline requests. The fix shipped in the upstream release before the first TuxCare commit, so the verdict is not_affected. The fix commit's author and commit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-06T11:32:00.041448+00:00", "status_notes": "Vulnerability CVE-2025-32395 does not affect version 7.3.2-tuxcare.2 of vite. not_affected \u2014 Not affected. The target (vite 7.3.2) already contains the upstream fix for CVE-2025-32395, the commit \"reject requests with # in request-target (#19830)\". It shipped in the upstream release, before any TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32395" }, "impact_statement": "not_affected \u2014 Not affected. The target (vite 7.3.2) already contains the upstream fix for CVE-2025-32395, the commit \"reject requests with # in request-target (#19830)\". It shipped in the upstream release, before any TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-03T23:56:29.502877+00:00", "status_notes": "Vulnerability CVE-2025-46565 does not affect version 7.3.2-tuxcare.2 of vite. not_affected \u2014 CVE-2025-46565 is not present in the target. The upstream vendor (Vite project) fixed this vulnerability in commit c22c43de612eebb6c182dd67850c24e4fab8cacb before the v7.3.2 release. The fix adds path validation via a shouldServe callback in sirv that strips trailing slashes before checking deny patterns, preventing the `/.env/.` bypass. This fix was already present in the upstream v7.3.2 relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46565" }, "impact_statement": "not_affected \u2014 CVE-2025-46565 is not present in the target. The upstream vendor (Vite project) fixed this vulnerability in commit c22c43de612eebb6c182dd67850c24e4fab8cacb before the v7.3.2 release. The fix adds path validation via a shouldServe callback in sirv that strips trailing slashes before checking deny patterns, preventing the `/.env/.` bypass. This fix was already present in the upstream v7.3.2 relea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-04T00:08:44.929582+00:00", "status_notes": "Vulnerability CVE-2025-58751 does not affect version 7.3.2-tuxcare.2 of vite. not_affected \u2014 CVE-2025-58751 is not present in vite 7.3.2-tuxcare.2. The vulnerability allowed path traversal via prefix-match bypass when serving files from the public directory. Both required fixes were already included in upstream Vite v7.1.5, which predates this TuxCare version. Fix 1: sirv@3.0.2 patch adds trailing separator to directory path (dir.endsWith(sep) ? dir : dir + sep) preventing /www/p from ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58751" }, "impact_statement": "not_affected \u2014 CVE-2025-58751 is not present in vite 7.3.2-tuxcare.2. The vulnerability allowed path traversal via prefix-match bypass when serving files from the public directory. Both required fixes were already included in upstream Vite v7.1.5, which predates this TuxCare version. Fix 1: sirv@3.0.2 patch adds trailing separator to directory path (dir.endsWith(sep) ? dir : dir + sep) preventing /www/p from ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-04T00:15:04.562941+00:00", "status_notes": "Vulnerability CVE-2025-58752 does not affect version 7.3.2-tuxcare.2 of vite. not_affected \u2014 CVE-2025-58752 describes a path traversal vulnerability allowing arbitrary HTML and sourcemap files to be served bypassing server.fs restrictions. The target repository (vite 7.3.2-tuxcare.2) already contains the upstream fixes: commit 14015d79 (HTML file serving validation) and commit 09d8c903 (sourcemap handler validation), both authored by green@sapphi.red and shipped in upstream release 7.3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58752" }, "impact_statement": "not_affected \u2014 CVE-2025-58752 describes a path traversal vulnerability allowing arbitrary HTML and sourcemap files to be served bypassing server.fs restrictions. The target repository (vite 7.3.2-tuxcare.2) already contains the upstream fixes: commit 14015d79 (HTML file serving validation) and commit 09d8c903 (sourcemap handler validation), both authored by green@sapphi.red and shipped in upstream release 7.3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-04T00:19:00.085681+00:00", "status_notes": "Vulnerability CVE-2025-62522 does not affect version 7.3.2-tuxcare.2 of vite. not_affected \u2014 The target repository (Vite 7.3.2-tuxcare.2) is not affected by CVE-2025-62522. The vulnerability allowed bypassing server.fs.deny patterns by appending a trailing backslash to URLs on Windows, exploiting the fact that fs.readFile normalizes paths after the security check. The upstream fix (commit f479cc57c) strips trailing slashes before checking deny patterns, and this fix was already include...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62522" }, "impact_statement": "not_affected \u2014 The target repository (Vite 7.3.2-tuxcare.2) is not affected by CVE-2025-62522. The vulnerability allowed bypassing server.fs.deny patterns by appending a trailing backslash to URLs on Windows, exploiting the fact that fs.readFile normalizes paths after the security check. The upstream fix (commit f479cc57c) strips trailing slashes before checking deny patterns, and this fix was already include..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-13T16:55:43.734532+00:00", "status_notes": "Vulnerability CVE-2026-112942 affects version 7.3.2-tuxcare.2 of vite, and is fixed in 7.3.2-tuxcare.3.", "vulnerability": { "name": "CVE-2026-112942" }, "action_statement": "Vulnerability CVE-2026-112942 affects version 7.3.2-tuxcare.2 of vite, and is fixed in 7.3.2-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-13T16:55:43.734532+00:00", "status_notes": "Vulnerability CVE-2026-112943 affects version 7.3.2-tuxcare.2 of vite, and is fixed in 7.3.2-tuxcare.3.", "vulnerability": { "name": "CVE-2026-112943" }, "action_statement": "Vulnerability CVE-2026-112943 affects version 7.3.2-tuxcare.2 of vite, and is fixed in 7.3.2-tuxcare.3." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-10-27T11:16:24.000460+00:00", "status_notes": "Vulnerability CVE-2026-112944 does not affect version 7.3.2-tuxcare.2 of vite. not_affected \u2014 Vite 7.3.2-tuxcare.1 uses launch-editor-middleware@2.14.1, which includes the defense against CLI flag injection (CVE-2026-112944) by converting file paths to absolute form before passing to editors. This defense successfully prevents paths starting with `+` or `-` from being interpreted as CLI flags for non-WSL users. However, the CVE explicitly documents that WSL users remain affected because...", "vulnerability": { "name": "CVE-2026-112944" }, "impact_statement": "not_affected \u2014 Vite 7.3.2-tuxcare.1 uses launch-editor-middleware@2.14.1, which includes the defense against CLI flag injection (CVE-2026-112944) by converting file paths to absolute form before passing to editors. This defense successfully prevents paths starting with `+` or `-` from being interpreted as CLI flags for non-WSL users. However, the CVE explicitly documents that WSL users remain affected because..." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-10-27T11:16:24.000460+00:00", "status_notes": "Vulnerability CVE-2026-112945 is fixed in version 7.3.2-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-112945" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-10-27T11:16:24.000460+00:00", "status_notes": "Vulnerability CVE-2026-112946 is fixed in version 7.3.2-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-112946" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-04T02:54:41.160467+00:00", "status_notes": "Vulnerability CVE-2026-112947 does not affect version 7.3.2-tuxcare.2 of vite. not_affected \u2014 Version 7.3.2 is not affected by CVE-2026-112947. The vulnerability concerns the `?vite-wasm-instance` query parameter that bypasses `server.fs` access controls, but this feature does not exist in version 7.3.2. The vulnerable code path was introduced in Vite 8.x (commit 9e79b5157, between v8.0.0 and v8.3.0) and fixed in v8.3.3 (commit ba8b7ab43). Target version 7.3.2 predates the feature entir...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112947" }, "impact_statement": "not_affected \u2014 Version 7.3.2 is not affected by CVE-2026-112947. The vulnerability concerns the `?vite-wasm-instance` query parameter that bypasses `server.fs` access controls, but this feature does not exist in version 7.3.2. The vulnerable code path was introduced in Vite 8.x (commit 9e79b5157, between v8.0.0 and v8.3.0) and fixed in v8.3.3 (commit ba8b7ab43). Target version 7.3.2 predates the feature entir..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-11-03T20:47:00.067740+00:00", "status_notes": "Vulnerability CVE-2026-118662 does not affect version 7.3.2-tuxcare.2 of vite. not_affected \u2014 The target Vite 7.3.2-tuxcare.2 is not affected by CVE-2026-118662. The vulnerability required PR #22160 to fix a bypass of server.fs.deny when special query parameters (?raw, ?import&raw, ?import&url&inline) were used. This fix was already included in the upstream Vite v7.3.2 release (commit f8103cc946, authored by green@sapphi.red on 2026-04-06). The fix adds a double-check in isServerAccessD...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-118662" }, "impact_statement": "not_affected \u2014 The target Vite 7.3.2-tuxcare.2 is not affected by CVE-2026-118662. The vulnerability required PR #22160 to fix a bypass of server.fs.deny when special query parameters (?raw, ?import&raw, ?import&url&inline) were used. This fix was already included in the upstream Vite v7.3.2 release (commit f8103cc946, authored by green@sapphi.red on 2026-04-06). The fix adds a double-check in isServerAccessD..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-10-27T11:16:24.000460+00:00", "status_notes": "Vulnerability CVE-2026-39363 does not affect version 7.3.2-tuxcare.2 of vite. The target (Vite v7.3.2) is NOT affected by CVE-2026-39363. The vulnerability\u2014whereby `fetchModule` exposed via WebSocket bypassed `server.fs` access control\u2014was fixed in upstream commit 19db0f29c (\"fix: backport #22159, apply server.fs check to env transport\") which was included in Vite v7.3.2 before release. The fix disables `fetchModule` for client (network-exposed) environments by setting `disableFetchModule: true` in config.ts and throwing an error in environment.ts when invoked. This blocks the attack path from WebSocket `vite:invoke` messages to arbitrary file content. The fix was authored by upstream Vite maintainer green@sapphi.red, not by TuxCare, so the verdict is not_affected (vendor-fix case) rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39363" }, "impact_statement": "The target (Vite v7.3.2) is NOT affected by CVE-2026-39363. The vulnerability\u2014whereby `fetchModule` exposed via WebSocket bypassed `server.fs` access control\u2014was fixed in upstream commit 19db0f29c (\"fix: backport #22159, apply server.fs check to env transport\") which was included in Vite v7.3.2 before release. The fix disables `fetchModule` for client (network-exposed) environments by setting `disableFetchModule: true` in config.ts and throwing an error in environment.ts when invoked. This blocks the attack path from WebSocket `vite:invoke` messages to arbitrary file content. The fix was authored by upstream Vite maintainer green@sapphi.red, not by TuxCare, so the verdict is not_affected (vendor-fix case) rather than already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-10-27T11:16:24.000460+00:00", "status_notes": "Vulnerability CVE-2026-39364 does not affect version 7.3.2-tuxcare.2 of vite. vite 7.3.2 is outside the affected version range for CVE-2026-39364 per the GitHub Security Advisory and NIST/NVD.", "vulnerability": { "name": "CVE-2026-39364" }, "impact_statement": "vite 7.3.2 is outside the affected version range for CVE-2026-39364 per the GitHub Security Advisory and NIST/NVD." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-10-27T11:16:24.000460+00:00", "status_notes": "Vulnerability CVE-2026-39365 does not affect version 7.3.2-tuxcare.2 of vite. not_affected \u2014 CVE-2026-39365 is NOT present in the target repository. The vulnerability describes a path traversal attack in Vite v7.3.1's optimized dependencies sourcemap handler, allowing attackers to read arbitrary .map files outside the project root by injecting ../ segments in URLs. The target is at version v7.3.2, which includes the upstream fix (commit 09d8c903b) that validates resolved paths using is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39365" }, "impact_statement": "not_affected \u2014 CVE-2026-39365 is NOT present in the target repository. The vulnerability describes a path traversal attack in Vite v7.3.1's optimized dependencies sourcemap handler, allowing attackers to read arbitrary .map files outside the project root by injecting ../ segments in URLs. The target is at version v7.3.2, which includes the upstream fix (commit 09d8c903b) that validates resolved paths using is..." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-10-27T11:16:24.000460+00:00", "status_notes": "Vulnerability CVE-2026-53571 is fixed in version 7.3.2-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-53571" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@7.3.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.2-tuxcare.2" } } ], "timestamp": "2026-10-27T11:16:24.000460+00:00", "status_notes": "Vulnerability CVE-2026-53632 is fixed in version 7.3.2-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-53632" } } ] }