{ "@id": "urn:uuid:9b8e563d-b75f-4f68-bfcc-0ec51cc2692f", "role": "Document Creator", "author": "https://tuxcare.com", "version": 24, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:58:39.634431+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 7.3.3-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 7.3.3-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 7.3.3-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 7.3.3-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-11-14T02:48:13.790854+00:00", "status_notes": "Vulnerability CVE-2023-49293 does not affect version 7.3.3-tuxcare.2 of vite. not_affected \u2014 Target (vite 7.3.3) already contains the upstream fix for CVE-2023-49293. The vulnerable `htmlPath = decodeURI(htmlPath)` in devHtmlHook (introduced by #13581, f8868afb) is absent, so the percent-encoded request URL is no longer decoded into literal quotes/angle brackets before it is embedded in the inline-module proxy `src`. The fix commit 5b8504048 (upstream author matias.capeletto@gmail.com)...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49293" }, "impact_statement": "not_affected \u2014 Target (vite 7.3.3) already contains the upstream fix for CVE-2023-49293. The vulnerable `htmlPath = decodeURI(htmlPath)` in devHtmlHook (introduced by #13581, f8868afb) is absent, so the percent-encoded request URL is no longer decoded into literal quotes/angle brackets before it is embedded in the inline-module proxy `src`. The fix commit 5b8504048 (upstream author matias.capeletto@gmail.com)..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-23331 affects version 7.3.3-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2024-23331" }, "action_statement": "Vulnerability CVE-2024-23331 affects version 7.3.3-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-11-03T23:47:46.204902+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 7.3.3-tuxcare.2 of vite. not_affected \u2014 CVE-2024-31207 (fs.deny bypass with directory patterns) is not present in Vite 7.3.3-tuxcare.3. The vulnerability involved picomatch configured with `matchBase: true` (only matches basenames, not full paths) and missing `dot: true` (fails to match dotfiles), allowing patterns like `**/.git/**` to be bypassed. The fix was introduced by upstream commit 242f550eb4 (Environment API refactor, Sept 2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "not_affected \u2014 CVE-2024-31207 (fs.deny bypass with directory patterns) is not present in Vite 7.3.3-tuxcare.3. The vulnerability involved picomatch configured with `matchBase: true` (only matches basenames, not full paths) and missing `dot: true` (fails to match dotfiles), allowing patterns like `**/.git/**` to be bypassed. The fix was introduced by upstream commit 242f550eb4 (Environment API refactor, Sept 2..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-45811 affects version 7.3.3-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2024-45811" }, "action_statement": "Vulnerability CVE-2024-45811 affects version 7.3.3-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-11-13T22:34:00.065751+00:00", "status_notes": "Vulnerability CVE-2024-45812 does not affect version 7.3.3-tuxcare.2 of vite. not_affected \u2014 The DOM clobbering fix for CVE-2024-45812 (upstream vite PR #18115, commit ade1d896) is already in the target. It shipped in the upstream vite 7.3.3 release, before the first TuxCare commit. getRelativeUrlFromDocument now requires document.currentScript.tagName to be SCRIPT, so a clobbering img element cannot supply the base URL.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45812" }, "impact_statement": "not_affected \u2014 The DOM clobbering fix for CVE-2024-45812 (upstream vite PR #18115, commit ade1d896) is already in the target. It shipped in the upstream vite 7.3.3 release, before the first TuxCare commit. getRelativeUrlFromDocument now requires document.currentScript.tagName to be SCRIPT, so a clobbering img element cannot supply the base URL." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-52011 affects version 7.3.3-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2024-52011" }, "action_statement": "Vulnerability CVE-2024-52011 affects version 7.3.3-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-11-03T23:56:16.973789+00:00", "status_notes": "Vulnerability CVE-2025-24010 does not affect version 7.3.3-tuxcare.2 of vite. not_affected \u2014 The target Vite 7.3.3 is NOT vulnerable to CVE-2025-24010. All three required security defenses (WebSocket token validation, Host header validation, and restrictive CORS with loopback-only origins) are present in the upstream Vite 7.3.3 release that TuxCare onboarded. The fixes were authored by the upstream Vite team and shipped in the v7.3.3 release (May 2026) before TuxCare's onboarding (July...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24010" }, "impact_statement": "not_affected \u2014 The target Vite 7.3.3 is NOT vulnerable to CVE-2025-24010. All three required security defenses (WebSocket token validation, Host header validation, and restrictive CORS with loopback-only origins) are present in the upstream Vite 7.3.3 release that TuxCare onboarded. The fixes were authored by the upstream Vite team and shipped in the v7.3.3 release (May 2026) before TuxCare's onboarding (July..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-11-06T11:25:00.048413+00:00", "status_notes": "Vulnerability CVE-2025-30208 does not affect version 7.3.3-tuxcare.2 of vite. not_affected \u2014 Vite 7.3.3-tuxcare.3 already contains the upstream fix for CVE-2025-30208. The serving-access check in the transform middleware uses the `[?&]raw\\b`, `[?&]url\\b` and `[?&]inline\\b` patterns, so `?raw??` and `?import&raw??` are recognised and subjected to the server.fs allow-list check. The fix is upstream commit 59673137c (#19761). It was already in the upstream release before TuxCare's first c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-30208" }, "impact_statement": "not_affected \u2014 Vite 7.3.3-tuxcare.3 already contains the upstream fix for CVE-2025-30208. The serving-access check in the transform middleware uses the `[?&]raw\\b`, `[?&]url\\b` and `[?&]inline\\b` patterns, so `?raw??` and `?import&raw??` are recognised and subjected to the server.fs allow-list check. The fix is upstream commit 59673137c (#19761). It was already in the upstream release before TuxCare's first c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-11-06T11:27:17.797774+00:00", "status_notes": "Vulnerability CVE-2025-31125 does not affect version 7.3.3-tuxcare.2 of vite. not_affected \u2014 Vite 7.3.3 already contains the upstream fix for CVE-2025-31125. Transform requests whose id carries ?raw, ?url, ?inline or a .svg suffix are checked against the server.fs allow/deny policy before the file is loaded. The fix shipped in the upstream release, before the first TuxCare commit, and was authored by upstream maintainers. TuxCare did not backport it on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31125" }, "impact_statement": "not_affected \u2014 Vite 7.3.3 already contains the upstream fix for CVE-2025-31125. Transform requests whose id carries ?raw, ?url, ?inline or a .svg suffix are checked against the server.fs allow/deny policy before the file is loaded. The fix shipped in the upstream release, before the first TuxCare commit, and was authored by upstream maintainers. TuxCare did not backport it on this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-11-06T11:35:03.680500+00:00", "status_notes": "Vulnerability CVE-2025-31486 does not affect version 7.3.3-tuxcare.2 of vite. not_affected \u2014 The upstream fix for CVE-2025-31486 (vitejs/vite commit 62d7e81, \"fix: fs check with svg and relative paths (#19782)\") is already in this vite 7.3.3-tuxcare.3 tree. It was part of the upstream release that TuxCare onboarded. The fs.strict check now runs on the resolved id inside loadAndTransform, before any plugin load. The svg and wasm handling uses the query-stripped id.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31486" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2025-31486 (vitejs/vite commit 62d7e81, \"fix: fs check with svg and relative paths (#19782)\") is already in this vite 7.3.3-tuxcare.3 tree. It was part of the upstream release that TuxCare onboarded. The fs.strict check now runs on the resolved id inside loadAndTransform, before any plugin load. The svg and wasm handling uses the query-stripped id." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-11-06T11:37:00.035304+00:00", "status_notes": "Vulnerability CVE-2025-32395 does not affect version 7.3.3-tuxcare.2 of vite. not_affected \u2014 Vite 7.3.3 already contains the upstream fix for CVE-2025-32395. rejectInvalidRequestMiddleware returns 400 for any request whose req.url contains '#'. It is registered ahead of all other dev-server middlewares. The fix came from upstream commit 175a83909 (author green@sapphi.red), which is part of the upstream release TuxCare onboarded, so this is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32395" }, "impact_statement": "not_affected \u2014 Vite 7.3.3 already contains the upstream fix for CVE-2025-32395. rejectInvalidRequestMiddleware returns 400 for any request whose req.url contains '#'. It is registered ahead of all other dev-server middlewares. The fix came from upstream commit 175a83909 (author green@sapphi.red), which is part of the upstream release TuxCare onboarded, so this is not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-11-03T23:57:41.357195+00:00", "status_notes": "Vulnerability CVE-2025-46565 does not affect version 7.3.3-tuxcare.2 of vite. not_affected \u2014 The target repository (Vite 7.3.3-tuxcare.3) is not affected by CVE-2025-46565. The vulnerability pattern has been removed by upstream commit c22c43de612eebb6c182dd67850c24e4fab8cacb, which was already present in the upstream release before TuxCare's work on this version branch. The fix moves file access validation inside sirv's shouldServe callback, preventing the `/.` path traversal bypass th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46565" }, "impact_statement": "not_affected \u2014 The target repository (Vite 7.3.3-tuxcare.3) is not affected by CVE-2025-46565. The vulnerability pattern has been removed by upstream commit c22c43de612eebb6c182dd67850c24e4fab8cacb, which was already present in the upstream release before TuxCare's work on this version branch. The fix moves file access validation inside sirv's shouldServe callback, preventing the `/.` path traversal bypass th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-11-04T00:09:39.314535+00:00", "status_notes": "Vulnerability CVE-2025-58751 does not affect version 7.3.3-tuxcare.2 of vite. not_affected \u2014 Target version 7.3.3-tuxcare.3 is NOT AFFECTED by CVE-2025-58751. The upstream vendor (vitejs) applied comprehensive fixes in v7.3.3 before TuxCare onboarding: (1) sirv upgraded to 3.0.2 with trailing-separator fix preventing prefix-match bypass (commit 09f2b52e8), and (2) HTML serving middleware enhanced with access control checks (commit 14015d794). Both commits are from upstream author green...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58751" }, "impact_statement": "not_affected \u2014 Target version 7.3.3-tuxcare.3 is NOT AFFECTED by CVE-2025-58751. The upstream vendor (vitejs) applied comprehensive fixes in v7.3.3 before TuxCare onboarding: (1) sirv upgraded to 3.0.2 with trailing-separator fix preventing prefix-match bypass (commit 09f2b52e8), and (2) HTML serving middleware enhanced with access control checks (commit 14015d794). Both commits are from upstream author green..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-11-04T00:18:30.099191+00:00", "status_notes": "Vulnerability CVE-2025-58752 does not affect version 7.3.3-tuxcare.2 of vite. not_affected \u2014 CVE-2025-58752 describes a path traversal vulnerability where HTML files were served regardless of server.fs settings because indexHtmlMiddleware lacked filesystem access validation. The target repository (Vite 7.3.3-tuxcare.3) is NOT AFFECTED because the upstream fix commit 14015d794 was already present in the upstream release that TuxCare onboarded. The fix adds checkLoadingAccess validation ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58752" }, "impact_statement": "not_affected \u2014 CVE-2025-58752 describes a path traversal vulnerability where HTML files were served regardless of server.fs settings because indexHtmlMiddleware lacked filesystem access validation. The target repository (Vite 7.3.3-tuxcare.3) is NOT AFFECTED because the upstream fix commit 14015d794 was already present in the upstream release that TuxCare onboarded. The fix adds checkLoadingAccess validation ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-11-04T00:18:30.099191+00:00", "status_notes": "Vulnerability CVE-2025-62522 does not affect version 7.3.3-tuxcare.2 of vite. not_affected \u2014 The target Vite 7.3.3-tuxcare.3 is NOT affected by CVE-2025-62522. The vulnerability (bypass of server.fs.deny via trailing slash) was fixed in upstream commit f479cc57c (October 20, 2025, Vite 7.1.11) before TuxCare began maintaining version 7.3.3. The fix code (lines 315-320 in packages/vite/src/node/server/middlewares/static.ts) strips trailing forward slashes from file paths before checking...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62522" }, "impact_statement": "not_affected \u2014 The target Vite 7.3.3-tuxcare.3 is NOT affected by CVE-2025-62522. The vulnerability (bypass of server.fs.deny via trailing slash) was fixed in upstream commit f479cc57c (October 20, 2025, Vite 7.1.11) before TuxCare began maintaining version 7.3.3. The fix code (lines 315-320 in packages/vite/src/node/server/middlewares/static.ts) strips trailing forward slashes from file paths before checking..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-11-14T02:58:39.634431+00:00", "status_notes": "Vulnerability CVE-2026-112942 affects version 7.3.3-tuxcare.2 of vite, and is fixed in 7.3.3-tuxcare.4.", "vulnerability": { "name": "CVE-2026-112942" }, "action_statement": "Vulnerability CVE-2026-112942 affects version 7.3.3-tuxcare.2 of vite, and is fixed in 7.3.3-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-10-20T19:02:00.467699+00:00", "status_notes": "Vulnerability CVE-2026-112943 does not affect version 7.3.3-tuxcare.2 of vite. not_affected \u2014 CVE-2026-112943 describes a command injection vulnerability in the `launch-editor` package due to failure to escape `%` characters when passing arguments to cmd.exe on Windows. The Vite repository (version 7.3.3-tuxcare.2) uses `launch-editor` as an external dependency via `launch-editor-middleware@2.14.1` but does not contain the vulnerable code itself. The vulnerability exists only in the dec...", "vulnerability": { "name": "CVE-2026-112943" }, "impact_statement": "not_affected \u2014 CVE-2026-112943 describes a command injection vulnerability in the `launch-editor` package due to failure to escape `%` characters when passing arguments to cmd.exe on Windows. The Vite repository (version 7.3.3-tuxcare.2) uses `launch-editor` as an external dependency via `launch-editor-middleware@2.14.1` but does not contain the vulnerable code itself. The vulnerability exists only in the dec..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-11-14T02:58:39.634431+00:00", "status_notes": "Vulnerability CVE-2026-112944 affects version 7.3.3-tuxcare.2 of vite, and is fixed in 7.3.3-tuxcare.4.", "vulnerability": { "name": "CVE-2026-112944" }, "action_statement": "Vulnerability CVE-2026-112944 affects version 7.3.3-tuxcare.2 of vite, and is fixed in 7.3.3-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-10-27T11:08:28.980217+00:00", "status_notes": "Vulnerability CVE-2026-112945 affects version 7.3.3-tuxcare.2 of vite, and is fixed in 7.3.3-tuxcare.3.", "vulnerability": { "name": "CVE-2026-112945" }, "action_statement": "Vulnerability CVE-2026-112945 affects version 7.3.3-tuxcare.2 of vite, and is fixed in 7.3.3-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-10-27T11:08:28.980217+00:00", "status_notes": "Vulnerability CVE-2026-112946 affects version 7.3.3-tuxcare.2 of vite, and is fixed in 7.3.3-tuxcare.3.", "vulnerability": { "name": "CVE-2026-112946" }, "action_statement": "Vulnerability CVE-2026-112946 affects version 7.3.3-tuxcare.2 of vite, and is fixed in 7.3.3-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-10-31T13:23:59.275184+00:00", "status_notes": "Vulnerability CVE-2026-112947 affects version 7.3.3-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-112947" }, "action_statement": "Vulnerability CVE-2026-112947 affects version 7.3.3-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-11-03T20:48:00.093952+00:00", "status_notes": "Vulnerability CVE-2026-118662 does not affect version 7.3.3-tuxcare.2 of vite. not_affected \u2014 CVE-2026-118662 describes a vulnerability where files denied by `server.fs.deny` can be retrieved by appending query parameters like `?raw`, `?import&raw`, or `?import&url&inline`. The fix (PR #22160) requires checking file access against BOTH the base path (without query params) AND the full path (with query params). Target version 7.3.3-tuxcare.3 already contains this fix from upstream v7.3.3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-118662" }, "impact_statement": "not_affected \u2014 CVE-2026-118662 describes a vulnerability where files denied by `server.fs.deny` can be retrieved by appending query parameters like `?raw`, `?import&raw`, or `?import&url&inline`. The fix (PR #22160) requires checking file access against BOTH the base path (without query params) AND the full path (with query params). Target version 7.3.3-tuxcare.3 already contains this fix from upstream v7.3.3..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-10-16T19:27:00.076654+00:00", "status_notes": "Vulnerability CVE-2026-39363 does not affect version 7.3.3-tuxcare.2 of vite. The target repository (Vite 7.3.3 at SHA 56498fb61) is not affected by CVE-2026-39363. The vulnerability, which allowed arbitrary file access via WebSocket `vite:invoke` events to the `fetchModule` method bypassing `server.fs` restrictions, was fixed by upstream Vite in commit 19db0f29c. This fix is already present in the target version. The defense disables `fetchModule` for client dev environments (which expose WebSocket to the network), preventing the attack path described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39363" }, "impact_statement": "The target repository (Vite 7.3.3 at SHA 56498fb61) is not affected by CVE-2026-39363. The vulnerability, which allowed arbitrary file access via WebSocket `vite:invoke` events to the `fetchModule` method bypassing `server.fs` restrictions, was fixed by upstream Vite in commit 19db0f29c. This fix is already present in the target version. The defense disables `fetchModule` for client dev environments (which expose WebSocket to the network), preventing the attack path described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-10-16T19:27:00.076654+00:00", "status_notes": "Vulnerability CVE-2026-39364 does not affect version 7.3.3-tuxcare.2 of vite. The target repository (Vite v7.3.3) is not affected by CVE-2026-39364. The vulnerability allowed bypassing server.fs.deny restrictions by appending query parameters (?raw, ?import&raw, etc.) to file requests. The upstream vendor fix (commit f8103cc94) was included in Vite v7.3.2 and is present in the target v7.3.3. The fix adds access control validation on both the cleaned URL (without query parameters) and the full URL, preventing the bypass. This is an upstream vendor fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39364" }, "impact_statement": "The target repository (Vite v7.3.3) is not affected by CVE-2026-39364. The vulnerability allowed bypassing server.fs.deny restrictions by appending query parameters (?raw, ?import&raw, etc.) to file requests. The upstream vendor fix (commit f8103cc94) was included in Vite v7.3.2 and is present in the target v7.3.3. The fix adds access control validation on both the cleaned URL (without query parameters) and the full URL, preventing the bypass. This is an upstream vendor fix, not a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-10-16T19:27:00.076654+00:00", "status_notes": "Vulnerability CVE-2026-39365 affects version 7.3.3-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-39365" }, "action_statement": "Vulnerability CVE-2026-39365 affects version 7.3.3-tuxcare.2 of vite." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-10-16T19:27:00.076654+00:00", "status_notes": "Vulnerability CVE-2026-53571 is fixed in version 7.3.3-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-53571" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@7.3.3-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@7.3.3-tuxcare.2" } } ], "timestamp": "2026-10-16T19:27:00.076654+00:00", "status_notes": "Vulnerability CVE-2026-53632 is fixed in version 7.3.3-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-53632" } } ] }