{ "@id": "urn:uuid:a54558ca-629e-4af3-b2d7-6b8040117b30", "role": "Document Creator", "author": "https://tuxcare.com", "version": 29, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T11:39:41.446655+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 7.3.6 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 7.3.6 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 7.3.6 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 7.3.6 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-49293 affects version 7.3.6 of vite.", "vulnerability": { "name": "CVE-2023-49293" }, "action_statement": "Vulnerability CVE-2023-49293 affects version 7.3.6 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-23331 affects version 7.3.6 of vite.", "vulnerability": { "name": "CVE-2024-23331" }, "action_statement": "Vulnerability CVE-2024-23331 affects version 7.3.6 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-11-03T23:49:06.171407+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 7.3.6 of vite. not_affected \u2014 The vulnerability CVE-2024-31207 is not present in Vite 7.3.6. The upstream fix for fs.deny with directory-based glob patterns was already incorporated into the upstream Vite 7.3.6 release through the Environment API refactor (commit 242f550eb, Sept 2024) before TuxCare onboarded this version. The target contains the complete fix with matchBase: false, dot: true, and pattern transformation to p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "not_affected \u2014 The vulnerability CVE-2024-31207 is not present in Vite 7.3.6. The upstream fix for fs.deny with directory-based glob patterns was already incorporated into the upstream Vite 7.3.6 release through the Environment API refactor (commit 242f550eb, Sept 2024) before TuxCare onboarded this version. The target contains the complete fix with matchBase: false, dot: true, and pattern transformation to p..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-45811 affects version 7.3.6 of vite.", "vulnerability": { "name": "CVE-2024-45811" }, "action_statement": "Vulnerability CVE-2024-45811 affects version 7.3.6 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-45812 affects version 7.3.6 of vite.", "vulnerability": { "name": "CVE-2024-45812" }, "action_statement": "Vulnerability CVE-2024-45812 affects version 7.3.6 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-52011 affects version 7.3.6 of vite.", "vulnerability": { "name": "CVE-2024-52011" }, "action_statement": "Vulnerability CVE-2024-52011 affects version 7.3.6 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-11-03T23:57:41.357195+00:00", "status_notes": "Vulnerability CVE-2025-24010 does not affect version 7.3.6 of vite. not_affected \u2014 The target (Vite v7.3.6, SHA 5599ef5dd3) is not affected by CVE-2025-24010. All three security defenses (WebSocket token validation, CORS restriction to loopback origins, and Host header validation) are present in the codebase. These fixes were introduced by upstream Vite maintainers in v4.5.6-4.5.9 (January 2025) and shipped with all subsequent releases including v7.3.6 (June 2026). The target...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24010" }, "impact_statement": "not_affected \u2014 The target (Vite v7.3.6, SHA 5599ef5dd3) is not affected by CVE-2025-24010. All three security defenses (WebSocket token validation, CORS restriction to loopback origins, and Host header validation) are present in the codebase. These fixes were introduced by upstream Vite maintainers in v4.5.6-4.5.9 (January 2025) and shipped with all subsequent releases including v7.3.6 (June 2026). The target..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-11-06T11:26:12.726685+00:00", "status_notes": "Vulnerability CVE-2025-30208 does not affect version 7.3.6 of vite. not_affected \u2014 Vite 7.3.6 is not affected by CVE-2025-30208. The upstream fix, 262b5ec7a (#19702, author green@sapphi.red), is an ancestor of HEAD and shipped in the upstream release. The `/@fs` access check was later refactored into `isServerAccessDeniedForTransform`, and it handles `?raw??` and `?import&raw??` correctly.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-30208" }, "impact_statement": "not_affected \u2014 Vite 7.3.6 is not affected by CVE-2025-30208. The upstream fix, 262b5ec7a (#19702, author green@sapphi.red), is an ancestor of HEAD and shipped in the upstream release. The `/@fs` access check was later refactored into `isServerAccessDeniedForTransform`, and it handles `?raw??` and `?import&raw??` correctly." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-11-06T11:29:00.045585+00:00", "status_notes": "Vulnerability CVE-2025-31125 does not affect version 7.3.6 of vite. not_affected \u2014 Vite 7.3.6 already contains the upstream fix for CVE-2025-31125 (commit 59673137, \"fix: fs check in transform middleware (#19761)\", authored by patak-dev). The fix shipped in the upstream release, so this is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31125" }, "impact_statement": "not_affected \u2014 Vite 7.3.6 already contains the upstream fix for CVE-2025-31125 (commit 59673137, \"fix: fs check in transform middleware (#19761)\", authored by patak-dev). The fix shipped in the upstream release, so this is an upstream fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-11-06T11:33:56.415971+00:00", "status_notes": "Vulnerability CVE-2025-31486 does not affect version 7.3.6 of vite. not_affected \u2014 Vite 7.3.6 already contains the upstream fix for CVE-2025-31486 (upstream commit 62d7e81ee, \"fix: fs check with svg and relative paths (#19782)\"). It is an ancestor of HEAD and shipped in the upstream release. The fs allow/deny check now runs on the resolved id and covers `.svg` ids. Because the fix is upstream-authored and no TuxCare commit carries it, the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31486" }, "impact_statement": "not_affected \u2014 Vite 7.3.6 already contains the upstream fix for CVE-2025-31486 (upstream commit 62d7e81ee, \"fix: fs check with svg and relative paths (#19782)\"). It is an ancestor of HEAD and shipped in the upstream release. The fs allow/deny check now runs on the resolved id and covers `.svg` ids. Because the fix is upstream-authored and no TuxCare commit carries it, the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-11-06T11:39:41.446655+00:00", "status_notes": "Vulnerability CVE-2025-32395 does not affect version 7.3.6 of vite. not_affected \u2014 Vite 7.3.6 already contains the upstream fix for CVE-2025-32395. A middleware rejects any request whose req.url contains '#' with HTTP 400, and it is registered ahead of every file-serving middleware. The fix is upstream commit 175a83909 by green@sapphi.red (#19830). It is an ancestor of HEAD and shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32395" }, "impact_statement": "not_affected \u2014 Vite 7.3.6 already contains the upstream fix for CVE-2025-32395. A middleware rejects any request whose req.url contains '#' with HTTP 400, and it is registered ahead of every file-serving middleware. The fix is upstream commit 175a83909 by green@sapphi.red (#19830). It is an ancestor of HEAD and shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-11-04T00:00:30.612202+00:00", "status_notes": "Vulnerability CVE-2025-46565 does not affect version 7.3.6 of vite. not_affected \u2014 The target Vite 7.3.6 is NOT AFFECTED by CVE-2025-46565. The vulnerability (bypassing server.fs.deny patterns via `/.` sequences) has been fixed by upstream commit c22c43de612eebb6c182dd67850c24e4fab8cacb, which was already included in the upstream release before TuxCare started maintaining this version. The fix moves file access validation inside sirv's `shouldServe` callback, ensuring the RES...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46565" }, "impact_statement": "not_affected \u2014 The target Vite 7.3.6 is NOT AFFECTED by CVE-2025-46565. The vulnerability (bypassing server.fs.deny patterns via `/.` sequences) has been fixed by upstream commit c22c43de612eebb6c182dd67850c24e4fab8cacb, which was already included in the upstream release before TuxCare started maintaining this version. The fix moves file access validation inside sirv's `shouldServe` callback, ensuring the RES..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-11-04T00:12:51.189964+00:00", "status_notes": "Vulnerability CVE-2025-58751 does not affect version 7.3.6 of vite. not_affected \u2014 CVE-2025-58751 is not present in this target. The vulnerability describes a path traversal issue where files outside the public directory can be accessed by exploiting: (1) undefined publicFiles when symlinks exist, causing all requests to bypass fs.deny checks, and (2) sirv's incorrect startsWith check after trimming trailing slashes (e.g., \"/www/private.txt\".startsWith(\"/www/p\") = true). The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58751" }, "impact_statement": "not_affected \u2014 CVE-2025-58751 is not present in this target. The vulnerability describes a path traversal issue where files outside the public directory can be accessed by exploiting: (1) undefined publicFiles when symlinks exist, causing all requests to bypass fs.deny checks, and (2) sirv's incorrect startsWith check after trimming trailing slashes (e.g., \"/www/private.txt\".startsWith(\"/www/p\") = true). The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-11-04T00:17:05.041397+00:00", "status_notes": "Vulnerability CVE-2025-58752 does not affect version 7.3.6 of vite. not_affected \u2014 The target repository at version 7.3.6 is not affected by CVE-2025-58752. The vulnerability fix was already present in the upstream Vite v7.3.6 release before TuxCare onboarded it. The fix adds filesystem access validation to HTML file serving in indexHtmlMiddleware, preventing path traversal attacks that bypass server.fs allow/deny rules. All fix components are present: access checks in dev mo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58752" }, "impact_statement": "not_affected \u2014 The target repository at version 7.3.6 is not affected by CVE-2025-58752. The vulnerability fix was already present in the upstream Vite v7.3.6 release before TuxCare onboarded it. The fix adds filesystem access validation to HTML file serving in indexHtmlMiddleware, preventing path traversal attacks that bypass server.fs allow/deny rules. All fix components are present: access checks in dev mo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-11-04T00:20:58.115438+00:00", "status_notes": "Vulnerability CVE-2025-62522 does not affect version 7.3.6 of vite. not_affected \u2014 The target Vite v7.3.6 is not affected by CVE-2025-62522. The vulnerability (bypassing server.fs.deny checks via trailing slash/backslash in URLs) was fixed by upstream commit f479cc57 on October 20, 2025. This fix was already included in the upstream v7.3.6 release (June 25, 2026) that TuxCare onboarded. The vulnerable pattern never existed in the TuxCare-managed version. The fix implementatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62522" }, "impact_statement": "not_affected \u2014 The target Vite v7.3.6 is not affected by CVE-2025-62522. The vulnerability (bypassing server.fs.deny checks via trailing slash/backslash in URLs) was fixed by upstream commit f479cc57 on October 20, 2025. This fix was already included in the upstream v7.3.6 release (June 25, 2026) that TuxCare onboarded. The vulnerable pattern never existed in the TuxCare-managed version. The fix implementatio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-10-20T20:31:00.076676+00:00", "status_notes": "Vulnerability CVE-2026-112942 does not affect version 7.3.6 of vite. not_affected \u2014 The Vite repository (version 7.3.6) is not affected by CVE-2026-112942. The vulnerability pattern described in the CVE\u2014specifically the fs.existsSync() bypass using crafted paths ending in \\\\..:line:column and the subsequent path parsing issues\u2014exists entirely within the external launch-editor and launch-editor-middleware packages, not in Vite's own source code. Vite declares launch-editor-midd...", "vulnerability": { "name": "CVE-2026-112942" }, "impact_statement": "not_affected \u2014 The Vite repository (version 7.3.6) is not affected by CVE-2026-112942. The vulnerability pattern described in the CVE\u2014specifically the fs.existsSync() bypass using crafted paths ending in \\\\..:line:column and the subsequent path parsing issues\u2014exists entirely within the external launch-editor and launch-editor-middleware packages, not in Vite's own source code. Vite declares launch-editor-midd..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-10-21T09:10:09.917264+00:00", "status_notes": "Vulnerability CVE-2026-112943 does not affect version 7.3.6 of vite. not_affected \u2014 CVE-2026-112943 affects the `launch-editor` package, which fails to escape `%` characters when passing arguments to cmd.exe on Windows, enabling command injection. Vite uses `launch-editor-middleware@^2.14.1` (which depends on `launch-editor`) as a declared dependency for the `/__open-in-editor` endpoint. However, Vite's repository contains NO implementation of the vulnerable functionality - no...", "vulnerability": { "name": "CVE-2026-112943" }, "impact_statement": "not_affected \u2014 CVE-2026-112943 affects the `launch-editor` package, which fails to escape `%` characters when passing arguments to cmd.exe on Windows, enabling command injection. Vite uses `launch-editor-middleware@^2.14.1` (which depends on `launch-editor`) as a declared dependency for the `/__open-in-editor` endpoint. However, Vite's repository contains NO implementation of the vulnerable functionality - no..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-10-20T19:57:00.094462+00:00", "status_notes": "Vulnerability CVE-2026-112944 affects version 7.3.6 of vite.", "vulnerability": { "name": "CVE-2026-112944" }, "action_statement": "Vulnerability CVE-2026-112944 affects version 7.3.6 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-10-21T16:56:40.126672+00:00", "status_notes": "Vulnerability CVE-2026-112945 affects version 7.3.6 of vite.", "vulnerability": { "name": "CVE-2026-112945" }, "action_statement": "Vulnerability CVE-2026-112945 affects version 7.3.6 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-10-21T16:56:40.126672+00:00", "status_notes": "Vulnerability CVE-2026-112946 affects version 7.3.6 of vite.", "vulnerability": { "name": "CVE-2026-112946" }, "action_statement": "Vulnerability CVE-2026-112946 affects version 7.3.6 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-11-04T02:56:00.043273+00:00", "status_notes": "Vulnerability CVE-2026-112947 does not affect version 7.3.6 of vite. not_affected \u2014 Vite v7.3.6 is not affected by CVE-2026-112947. The vulnerability requires the `?vite-wasm-instance` query parameter handling feature, which was introduced in commit 9e79b5157 on July 16, 2026, first shipped in v8.2.0. The target v7.3.6 was released on June 25, 2026 (21 days before the feature existed). Exhaustive searches confirm no handling of `?vite-wasm-instance` in the v7.3.6 codebase. The...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112947" }, "impact_statement": "not_affected \u2014 Vite v7.3.6 is not affected by CVE-2026-112947. The vulnerability requires the `?vite-wasm-instance` query parameter handling feature, which was introduced in commit 9e79b5157 on July 16, 2026, first shipped in v8.2.0. The target v7.3.6 was released on June 25, 2026 (21 days before the feature existed). Exhaustive searches confirm no handling of `?vite-wasm-instance` in the v7.3.6 codebase. The..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-11-03T20:48:31.733723+00:00", "status_notes": "Vulnerability CVE-2026-118662 does not affect version 7.3.6 of vite. not_affected \u2014 The target version 7.3.6 is NOT vulnerable to CVE-2026-118662. The fix from PR #22160 (commit f8103cc946f137a54e395fe3f5d08e8209231ed6) that prevents bypassing server.fs.deny checks via query parameters was already included in the upstream Vite v7.3.6 release (2026-06-25) before TuxCare onboarded it. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-118662" }, "impact_statement": "not_affected \u2014 The target version 7.3.6 is NOT vulnerable to CVE-2026-118662. The fix from PR #22160 (commit f8103cc946f137a54e395fe3f5d08e8209231ed6) that prevents bypassing server.fs.deny checks via query parameters was already included in the upstream Vite v7.3.6 release (2026-06-25) before TuxCare onboarded it. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-39363 does not affect version 7.3.6 of vite. CVE-2026-39363 describes a vulnerability where Vite's WebSocket `fetchModule` method bypassed `server.fs` access controls, allowing arbitrary file reads via `vite:invoke` events with `file://...?raw` URLs. The target repository (Vite v7.3.6+3) is NOT AFFECTED because the upstream vendor fix (commit 19db0f29c by \u7fe0 , included in v7.3.2) has already eliminated the vulnerable pattern. The fix disables `fetchModule` in the client environment (`disableFetchModule: true` in config.ts) and enforces `server.fs` validation in `transformRequest` via `isServerAccessDeniedForTransform` checks. This is an upstream vendor fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39363" }, "impact_statement": "CVE-2026-39363 describes a vulnerability where Vite's WebSocket `fetchModule` method bypassed `server.fs` access controls, allowing arbitrary file reads via `vite:invoke` events with `file://...?raw` URLs. The target repository (Vite v7.3.6+3) is NOT AFFECTED because the upstream vendor fix (commit 19db0f29c by \u7fe0 , included in v7.3.2) has already eliminated the vulnerable pattern. The fix disables `fetchModule` in the client environment (`disableFetchModule: true` in config.ts) and enforces `server.fs` validation in `transformRequest` via `isServerAccessDeniedForTransform` checks. This is an upstream vendor fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-39364 does not affect version 7.3.6 of vite. The target repository (Vite 7.3.6) is not affected by CVE-2026-39364. The vulnerability allowed bypassing server.fs.deny restrictions by appending query parameters (?raw, ?import&raw, ?import&url&inline) to file paths, enabling access to blocked files like .env. The fix was applied by upstream Vite developers in commit f8103cc94 (part of version 7.3.2 release), which added dual permission checks on both query-stripped and original paths. Since the target version 7.3.6 > 7.3.2, it already contains this upstream vendor fix. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39364" }, "impact_statement": "The target repository (Vite 7.3.6) is not affected by CVE-2026-39364. The vulnerability allowed bypassing server.fs.deny restrictions by appending query parameters (?raw, ?import&raw, ?import&url&inline) to file paths, enabling access to blocked files like .env. The fix was applied by upstream Vite developers in commit f8103cc94 (part of version 7.3.2 release), which added dual permission checks on both query-stripped and original paths. Since the target version 7.3.6 > 7.3.2, it already contains this upstream vendor fix. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-39365 does not affect version 7.3.6 of vite. not_affected \u2014 CVE-2026-39365 is NOT present in Vite 7.3.6. The vulnerability (path traversal in .map file requests for optimized dependencies) was fixed by upstream commit 09d8c903b authored by Vite maintainer green@sapphi.red, which was included in Vite v7.3.2 and all subsequent releases including the target version 7.3.6. The fix adds validation (`isOptimizedDepFile` check) to ensure resolved sourcemap pat...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39365" }, "impact_statement": "not_affected \u2014 CVE-2026-39365 is NOT present in Vite 7.3.6. The vulnerability (path traversal in .map file requests for optimized dependencies) was fixed by upstream commit 09d8c903b authored by Vite maintainer green@sapphi.red, which was included in Vite v7.3.2 and all subsequent releases including the target version 7.3.6. The fix adds validation (`isOptimizedDepFile` check) to ensure resolved sourcemap pat..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-10-15T21:35:00.382757+00:00", "status_notes": "Vulnerability CVE-2026-53571 does not affect version 7.3.6 of vite. The target repository (Vite v7.3.6) is not affected by CVE-2026-53571. The vulnerability, which allowed bypassing file access controls on Windows via NTFS Alternate Data Streams (e.g., `.env::$DATA`) and 8.3 short names (e.g., `ENV~1`), has been fixed by upstream Vite developers. The fix was introduced in commit 8c1855607b (part of the v7.3.5 release) and is present in the current v7.3.6 codebase. The defensive code in `packages/vite/src/node/server/middlewares/static.ts` (lines 302-313) correctly rejects file paths containing `~` (Windows 8.3 short names) and `:` after the drive letter (NTFS ADS), preventing the attack vector described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53571" }, "impact_statement": "The target repository (Vite v7.3.6) is not affected by CVE-2026-53571. The vulnerability, which allowed bypassing file access controls on Windows via NTFS Alternate Data Streams (e.g., `.env::$DATA`) and 8.3 short names (e.g., `ENV~1`), has been fixed by upstream Vite developers. The fix was introduced in commit 8c1855607b (part of the v7.3.5 release) and is present in the current v7.3.6 codebase. The defensive code in `packages/vite/src/node/server/middlewares/static.ts` (lines 302-313) correctly rejects file paths containing `~` (Windows 8.3 short names) and `:` after the drive letter (NTFS ADS), preventing the attack vector described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.3.6", "identifiers": { "purl": "pkg:npm/vite@7.3.6" } } ], "timestamp": "2026-11-04T02:46:08.849210+00:00", "status_notes": "Vulnerability CVE-2026-53632 does not affect version 7.3.6 of vite. not_affected \u2014 The target (Vite 7.3.6) is not affected by CVE-2026-53632. The vulnerability involves UNC paths passed to the launch-editor package causing NTLM authentication leaks on Windows. The fix\u2014upgrading launch-editor-middleware from 2.12.0 to 2.14.1 to reject UNC paths\u2014was already present in the upstream Vite v7.3.5 release (May 2026) before TuxCare onboarded v7.3.6. The defense rejects file paths sta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53632" }, "impact_statement": "not_affected \u2014 The target (Vite 7.3.6) is not affected by CVE-2026-53632. The vulnerability involves UNC paths passed to the launch-editor package causing NTLM authentication leaks on Windows. The fix\u2014upgrading launch-editor-middleware from 2.12.0 to 2.14.1 to reject UNC paths\u2014was already present in the upstream Vite v7.3.5 release (May 2026) before TuxCare onboarded v7.3.6. The defense rejects file paths sta..." } ] }