{ "@id": "urn:uuid:36a9e57b-de46-4a62-ba8c-ea491a693fcd", "role": "Document Creator", "author": "https://tuxcare.com", "version": 20, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T22:37:00.098576+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 8.0.10-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 8.0.10-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 8.0.10-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 8.0.10-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-49293 affects version 8.0.10-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2023-49293" }, "action_statement": "Vulnerability CVE-2023-49293 affects version 8.0.10-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-23331 affects version 8.0.10-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2024-23331" }, "action_statement": "Vulnerability CVE-2024-23331 affects version 8.0.10-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-03T23:49:23.809666+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 8.0.10-tuxcare.2 of vite. not_affected \u2014 CVE-2024-31207 is not present in Vite 8.0.10-tuxcare.2. The vulnerability involved incorrect picomatch configuration for server.fs.deny patterns, allowing access to files that should be blocked by directory-based glob patterns (e.g., `**/.git/**`) due to `matchBase: true` bug and missing `dot: true` option. The fix was already present in the upstream Vite 8.0.10 release (commit ba5269cca by gre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "not_affected \u2014 CVE-2024-31207 is not present in Vite 8.0.10-tuxcare.2. The vulnerability involved incorrect picomatch configuration for server.fs.deny patterns, allowing access to files that should be blocked by directory-based glob patterns (e.g., `**/.git/**`) due to `matchBase: true` bug and missing `dot: true` option. The fix was already present in the upstream Vite 8.0.10 release (commit ba5269cca by gre..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-03T23:52:00.070015+00:00", "status_notes": "Vulnerability CVE-2024-45811 does not affect version 8.0.10-tuxcare.2 of vite. not_affected \u2014 CVE-2024-45811 is not present in Vite 8.0.10-tuxcare.2. The upstream Vite 8.0.10 release includes a fix via the `isServerAccessDeniedForTransform` function (commit a9a3df2993 by upstream author green@sapphi.red) that validates filesystem access restrictions for URLs containing `?raw` or `?url` query parameters. This defense blocks the bypass attack described in the CVE where adding `?import&raw...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45811" }, "impact_statement": "not_affected \u2014 CVE-2024-45811 is not present in Vite 8.0.10-tuxcare.2. The upstream Vite 8.0.10 release includes a fix via the `isServerAccessDeniedForTransform` function (commit a9a3df2993 by upstream author green@sapphi.red) that validates filesystem access restrictions for URLs containing `?raw` or `?url` query parameters. This defense blocks the bypass attack described in the CVE where adding `?import&raw..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-13T22:37:00.098576+00:00", "status_notes": "Vulnerability CVE-2024-45812 does not affect version 8.0.10-tuxcare.2 of vite. not_affected \u2014 The DOM-clobbering fix is already in the target. getRelativeUrlFromDocument in packages/vite/src/node/build.ts:1541-1547 only uses document.currentScript.src when its tagName is SCRIPT, as in the upstream patch. The fix is upstream commit ade1d8966 by a non-TuxCare author, and it predates the first TuxCare commit. The verdict is not_affected, not already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45812" }, "impact_statement": "not_affected \u2014 The DOM-clobbering fix is already in the target. getRelativeUrlFromDocument in packages/vite/src/node/build.ts:1541-1547 only uses document.currentScript.src when its tagName is SCRIPT, as in the upstream patch. The fix is upstream commit ade1d8966 by a non-TuxCare author, and it predates the first TuxCare commit. The verdict is not_affected, not already_fixed." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-52011 affects version 8.0.10-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2024-52011" }, "action_statement": "Vulnerability CVE-2024-52011 affects version 8.0.10-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-03T23:58:45.680561+00:00", "status_notes": "Vulnerability CVE-2025-24010 does not affect version 8.0.10-tuxcare.2 of vite. not_affected \u2014 The target (Vite 8.0.10-tuxcare.2) is not affected by CVE-2025-24010. All three vulnerability patterns described in the CVE have been fixed by upstream commits that shipped in the upstream release before TuxCare's maintenance began. The fixes install: (1) CORS restricted to loopback origins only via regex pattern, (2) WebSocket token authentication with timing-safe validation, and (3) Host head...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24010" }, "impact_statement": "not_affected \u2014 The target (Vite 8.0.10-tuxcare.2) is not affected by CVE-2025-24010. All three vulnerability patterns described in the CVE have been fixed by upstream commits that shipped in the upstream release before TuxCare's maintenance began. The fixes install: (1) CORS restricted to loopback origins only via regex pattern, (2) WebSocket token authentication with timing-safe validation, and (3) Host head..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-06T11:26:42.233420+00:00", "status_notes": "Vulnerability CVE-2025-30208 does not affect version 8.0.10-tuxcare.2 of vite. not_affected \u2014 Vite 8.0.10 is not affected by CVE-2025-30208. The upstream fix (#19702) patched the 6.x middleware, which no longer exists in this form. In 8.x the fs.allow check runs on the resolved id inside loadAndTransform, before any plugin loads the file. That check uses a lenient rawRE (/[?&]raw\\b/) and cleanUrl, so trailing '?' separators cannot bypass it. A request like /@fs/tmp/secret.txt?import&raw...", "vulnerability": { "name": "CVE-2025-30208" }, "impact_statement": "not_affected \u2014 Vite 8.0.10 is not affected by CVE-2025-30208. The upstream fix (#19702) patched the 6.x middleware, which no longer exists in this form. In 8.x the fs.allow check runs on the resolved id inside loadAndTransform, before any plugin loads the file. That check uses a lenient rawRE (/[?&]raw\\b/) and cleanUrl, so trailing '?' separators cannot bypass it. A request like /@fs/tmp/secret.txt?import&raw..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-06T11:26:42.233420+00:00", "status_notes": "Vulnerability CVE-2025-31125 does not affect version 8.0.10-tuxcare.2 of vite. not_affected \u2014 Target (vite 8.0.10-tuxcare.2) already contains the upstream fix for CVE-2025-31125 (commit 59673137, \"fix: fs check in transform middleware (#19761)\"), shipped in the upstream release TuxCare onboarded. Requests for non-allowed files with ?raw / ?url / ?inline / ?import query forms are denied by an fs access check in the transform pipeline.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31125" }, "impact_statement": "not_affected \u2014 Target (vite 8.0.10-tuxcare.2) already contains the upstream fix for CVE-2025-31125 (commit 59673137, \"fix: fs check in transform middleware (#19761)\"), shipped in the upstream release TuxCare onboarded. Requests for non-allowed files with ?raw / ?url / ?inline / ?import query forms are denied by an fs access check in the transform pipeline." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-06T11:32:00.041448+00:00", "status_notes": "Vulnerability CVE-2025-31486 does not affect version 8.0.10-tuxcare.2 of vite. not_affected \u2014 Vite 8.0.10 already contains the upstream fix for CVE-2025-31486 (commit 62d7e81ee, \"fix: fs check with svg and relative paths (#19782)\", by patak-dev). The fs.strict and fs.deny check now runs on the resolved, normalized id inside loadAndTransform, and it covers .svg, ?raw, ?url and ?inline ids. The fix is an ancestor of HEAD and predates the first TuxCare commit, so it shipped in the upstream...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31486" }, "impact_statement": "not_affected \u2014 Vite 8.0.10 already contains the upstream fix for CVE-2025-31486 (commit 62d7e81ee, \"fix: fs check with svg and relative paths (#19782)\", by patak-dev). The fs.strict and fs.deny check now runs on the resolved, normalized id inside loadAndTransform, and it covers .svg, ?raw, ?url and ?inline ids. The fix is an ancestor of HEAD and predates the first TuxCare commit, so it shipped in the upstream..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-06T11:35:03.680500+00:00", "status_notes": "Vulnerability CVE-2025-32395 does not affect version 8.0.10-tuxcare.2 of vite. not_affected \u2014 Not affected. Vite 8.0.10 already contains the upstream fix for CVE-2025-32395: rejectInvalidRequestMiddleware returns 400 for any request whose req.url contains '#'. It is registered as the first internal middleware, so requests with an embedded fragment never reach the fs.deny, /@fs or static checks. The fix commit 175a83909 is by upstream (green@sapphi.red, committer noreply@github.com) and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32395" }, "impact_statement": "not_affected \u2014 Not affected. Vite 8.0.10 already contains the upstream fix for CVE-2025-32395: rejectInvalidRequestMiddleware returns 400 for any request whose req.url contains '#'. It is registered as the first internal middleware, so requests with an embedded fragment never reach the fs.deny, /@fs or static checks. The fix commit 175a83909 is by upstream (green@sapphi.red, committer noreply@github.com) and ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-03T23:58:45.680561+00:00", "status_notes": "Vulnerability CVE-2025-46565 does not affect version 8.0.10-tuxcare.2 of vite. not_affected \u2014 The target Vite 8.0.10-tuxcare.2 is not affected by CVE-2025-46565. The vulnerability allows bypassing server.fs.deny patterns using slash-dot sequences (e.g., /.env/.) to access sensitive files under the project root. The fix was already present in the upstream Vite 8.0.10 release that TuxCare started from. The security fix (commit c22c43de6) moves file access validation from pre-resolution UR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46565" }, "impact_statement": "not_affected \u2014 The target Vite 8.0.10-tuxcare.2 is not affected by CVE-2025-46565. The vulnerability allows bypassing server.fs.deny patterns using slash-dot sequences (e.g., /.env/.) to access sensitive files under the project root. The fix was already present in the upstream Vite 8.0.10 release that TuxCare started from. The security fix (commit c22c43de6) moves file access validation from pre-resolution UR..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-04T00:07:54.567237+00:00", "status_notes": "Vulnerability CVE-2025-58751 does not affect version 8.0.10-tuxcare.2 of vite. not_affected \u2014 CVE-2025-58751 (path traversal via sirv's incorrect startsWith check when public directory lacks trailing separator) is not present in vite 8.0.10-tuxcare.2. The vulnerability was fixed in upstream commit 09f2b52e8 (authored by green@sapphi.red) which upgraded sirv to 3.0.2 with patches ensuring directory paths always end with separators before startsWith() comparison. This fix was already incl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58751" }, "impact_statement": "not_affected \u2014 CVE-2025-58751 (path traversal via sirv's incorrect startsWith check when public directory lacks trailing separator) is not present in vite 8.0.10-tuxcare.2. The vulnerability was fixed in upstream commit 09f2b52e8 (authored by green@sapphi.red) which upgraded sirv to 3.0.2 with patches ensuring directory paths always end with separators before startsWith() comparison. This fix was already incl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-04T00:16:00.125872+00:00", "status_notes": "Vulnerability CVE-2025-58752 does not affect version 8.0.10-tuxcare.2 of vite. not_affected \u2014 The target repository (vite 8.0.10-tuxcare.2) is NOT affected by CVE-2025-58752. The vulnerability pattern described in the CVE\u2014HTML files served without fs.allow/fs.deny checks\u2014is not present because upstream vendor fixes were already included in the v8.0.10 release. The fixes (commits 14015d794 for HTML middleware and 79f002f22 for sourcemap handler) were committed by upstream author green@sa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58752" }, "impact_statement": "not_affected \u2014 The target repository (vite 8.0.10-tuxcare.2) is NOT affected by CVE-2025-58752. The vulnerability pattern described in the CVE\u2014HTML files served without fs.allow/fs.deny checks\u2014is not present because upstream vendor fixes were already included in the v8.0.10 release. The fixes (commits 14015d794 for HTML middleware and 79f002f22 for sourcemap handler) were committed by upstream author green@sa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-04T00:16:00.125872+00:00", "status_notes": "Vulnerability CVE-2025-62522 does not affect version 8.0.10-tuxcare.2 of vite. not_affected \u2014 CVE-2025-62522 (fs.deny bypass via trailing slash) is NOT present in this target. The upstream vendor fix (commit f479cc57c) was already included in the Vite release that TuxCare onboarded. The vulnerable pattern - checking deny-list patterns without normalizing trailing slashes - has been removed. The code at packages/vite/src/node/server/middlewares/static.ts:317-320 strips trailing slashes b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62522" }, "impact_statement": "not_affected \u2014 CVE-2025-62522 (fs.deny bypass via trailing slash) is NOT present in this target. The upstream vendor fix (commit f479cc57c) was already included in the Vite release that TuxCare onboarded. The vulnerable pattern - checking deny-list patterns without normalizing trailing slashes - has been removed. The code at packages/vite/src/node/server/middlewares/static.ts:317-320 strips trailing slashes b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-10-27T11:05:28.970625+00:00", "status_notes": "Vulnerability CVE-2026-112942 does not affect version 8.0.10-tuxcare.2 of vite. not_affected \u2014 CVE-2026-112942 affects the launch-editor package (a declared dependency), not Vite's own source code. The vulnerable fs.existsSync() bypass logic exists in launch-editor@2.14.1, which Vite uses via launch-editor-middleware@2.14.1. While Vite exposes the /__open-in-editor endpoint that routes to this vulnerable dependency, no vendored copy of launch-editor exists in the repository. The fix requ...", "vulnerability": { "name": "CVE-2026-112942" }, "impact_statement": "not_affected \u2014 CVE-2026-112942 affects the launch-editor package (a declared dependency), not Vite's own source code. The vulnerable fs.existsSync() bypass logic exists in launch-editor@2.14.1, which Vite uses via launch-editor-middleware@2.14.1. While Vite exposes the /__open-in-editor endpoint that routes to this vulnerable dependency, no vendored copy of launch-editor exists in the repository. The fix requ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-10-27T11:05:28.970625+00:00", "status_notes": "Vulnerability CVE-2026-112943 does not affect version 8.0.10-tuxcare.2 of vite. not_affected \u2014 CVE-2026-112943 affects the `launch-editor` package (version 2.14.1), which Vite uses as a transitive dependency via launch-editor-middleware@2.14.1. The vulnerable code (Windows cmd.exe argument escaping logic that fails to escape `%` characters) is NOT present in Vite's source tree. Vite only declares this as a dependency in package.json and delegates to it through the `/__open-in-editor` end...", "vulnerability": { "name": "CVE-2026-112943" }, "impact_statement": "not_affected \u2014 CVE-2026-112943 affects the `launch-editor` package (version 2.14.1), which Vite uses as a transitive dependency via launch-editor-middleware@2.14.1. The vulnerable code (Windows cmd.exe argument escaping logic that fails to escape `%` characters) is NOT present in Vite's source tree. Vite only declares this as a dependency in package.json and delegates to it through the `/__open-in-editor` end..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-10-27T11:05:28.970625+00:00", "status_notes": "Vulnerability CVE-2026-112944 affects version 8.0.10-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-112944" }, "action_statement": "Vulnerability CVE-2026-112944 affects version 8.0.10-tuxcare.2 of vite." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-10-27T11:05:28.970625+00:00", "status_notes": "Vulnerability CVE-2026-112945 is fixed in version 8.0.10-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-112945" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-10-27T11:05:28.970625+00:00", "status_notes": "Vulnerability CVE-2026-112946 is fixed in version 8.0.10-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-112946" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-04T02:54:41.160467+00:00", "status_notes": "Vulnerability CVE-2026-112947 does not affect version 8.0.10-tuxcare.2 of vite. not_affected \u2014 The target Vite version 8.0.10-tuxcare.2 is NOT vulnerable to CVE-2026-112947. The vulnerability requires the WASM ESM Integration feature that handles `?vite-wasm-instance` query parameters, which was introduced in Vite v8.1.0 (commit c23d85b96). Version 8.0.10 predates this feature entirely - its wasm plugin only handles `.wasm?init` queries, not `?vite-wasm-instance`. Without the vulnerable ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112947" }, "impact_statement": "not_affected \u2014 The target Vite version 8.0.10-tuxcare.2 is NOT vulnerable to CVE-2026-112947. The vulnerability requires the WASM ESM Integration feature that handles `?vite-wasm-instance` query parameters, which was introduced in Vite v8.1.0 (commit c23d85b96). Version 8.0.10 predates this feature entirely - its wasm plugin only handles `.wasm?init` queries, not `?vite-wasm-instance`. Without the vulnerable ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-03T20:48:00.093952+00:00", "status_notes": "Vulnerability CVE-2026-118662 does not affect version 8.0.10-tuxcare.2 of vite. not_affected \u2014 CVE-2026-118662 affects Vite versions that have PR #20410 but lack PR #22160, allowing server.fs.deny bypass via query parameters like ?raw. The target (Vite 8.0.10-tuxcare.2) is NOT AFFECTED because the fix from PR #22160 was already present in upstream Vite 8.0.10 (released April 23, 2026) before TuxCare onboarded it. The code at packages/vite/src/node/server/middlewares/transform.ts:64-68 co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-118662" }, "impact_statement": "not_affected \u2014 CVE-2026-118662 affects Vite versions that have PR #20410 but lack PR #22160, allowing server.fs.deny bypass via query parameters like ?raw. The target (Vite 8.0.10-tuxcare.2) is NOT AFFECTED because the fix from PR #22160 was already present in upstream Vite 8.0.10 (released April 23, 2026) before TuxCare onboarded it. The code at packages/vite/src/node/server/middlewares/transform.ts:64-68 co..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-10-30T14:47:00.151806+00:00", "status_notes": "Vulnerability CVE-2026-39363 affects version 8.0.10-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-39363" }, "action_statement": "Vulnerability CVE-2026-39363 affects version 8.0.10-tuxcare.2 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-10-30T14:48:00.154664+00:00", "status_notes": "Vulnerability CVE-2026-39364 affects version 8.0.10-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-39364" }, "action_statement": "Vulnerability CVE-2026-39364 affects version 8.0.10-tuxcare.2 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-11-06T11:39:41.446655+00:00", "status_notes": "Vulnerability CVE-2026-39365 does not affect version 8.0.10-tuxcare.2 of vite. not_affected \u2014 The target (vite 8.0.10) already contains the upstream fix for CVE-2026-39365. The optimized-deps sourcemap handler in transform.ts rejects any resolved path outside the deps cache directory before reading the file. The fix is upstream commit 79f002f22 by green@sapphi.red, which is part of the upstream release TuxCare onboarded, so no TuxCare backport is involved.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39365" }, "impact_statement": "not_affected \u2014 The target (vite 8.0.10) already contains the upstream fix for CVE-2026-39365. The optimized-deps sourcemap handler in transform.ts rejects any resolved path outside the deps cache directory before reading the file. The fix is upstream commit 79f002f22 by green@sapphi.red, which is part of the upstream release TuxCare onboarded, so no TuxCare backport is involved." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-10-27T11:05:28.970625+00:00", "status_notes": "Vulnerability CVE-2026-53571 is fixed in version 8.0.10-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-53571" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/vite@8.0.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/vite@8.0.10-tuxcare.2" } } ], "timestamp": "2026-10-27T11:05:28.970625+00:00", "status_notes": "Vulnerability CVE-2026-53632 is fixed in version 8.0.10-tuxcare.2 of vite.", "vulnerability": { "name": "CVE-2026-53632" } } ] }