{ "@id": "urn:uuid:8b4bd2e6-263e-4be1-8548-b63a01de62f9", "role": "Document Creator", "author": "https://tuxcare.com", "version": 23, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T11:40:00.636701+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 8.0.8 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 8.0.8 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 8.0.8 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 8.0.8 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-49293 affects version 8.0.8 of vite.", "vulnerability": { "name": "CVE-2023-49293" }, "action_statement": "Vulnerability CVE-2023-49293 affects version 8.0.8 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-23331 affects version 8.0.8 of vite.", "vulnerability": { "name": "CVE-2024-23331" }, "action_statement": "Vulnerability CVE-2024-23331 affects version 8.0.8 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-11-03T23:47:44.058977+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 8.0.8 of vite. not_affected \u2014 CVE-2024-31207 affects Vite's server.fs.deny option which failed to properly deny requests for glob patterns containing directory components (e.g., **/.git/**) due to picomatch being used with matchBase: true (which only matches basename, not full path) and without dot: true (which caused dotfiles not to be denied). The target repository (Vite 8.0.8-tuxcare.1) is NOT AFFECTED because the upstre...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "not_affected \u2014 CVE-2024-31207 affects Vite's server.fs.deny option which failed to properly deny requests for glob patterns containing directory components (e.g., **/.git/**) due to picomatch being used with matchBase: true (which only matches basename, not full path) and without dot: true (which caused dotfiles not to be denied). The target repository (Vite 8.0.8-tuxcare.1) is NOT AFFECTED because the upstre..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-45811 affects version 8.0.8 of vite.", "vulnerability": { "name": "CVE-2024-45811" }, "action_statement": "Vulnerability CVE-2024-45811 affects version 8.0.8 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-45812 affects version 8.0.8 of vite.", "vulnerability": { "name": "CVE-2024-45812" }, "action_statement": "Vulnerability CVE-2024-45812 affects version 8.0.8 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-52011 affects version 8.0.8 of vite.", "vulnerability": { "name": "CVE-2024-52011" }, "action_statement": "Vulnerability CVE-2024-52011 affects version 8.0.8 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-11-03T23:54:47.027181+00:00", "status_notes": "Vulnerability CVE-2025-24010 does not affect version 8.0.8 of vite. not_affected \u2014 Vite 8.0.8-tuxcare.1 is NOT affected by CVE-2025-24010. All three security fixes (WebSocket token authentication, CORS restricted to loopback origins, and Host header validation) were already present in the upstream Vite v8.0.8 release (April 2026) when TuxCare onboarded it. The fixes were implemented by the upstream maintainer (sapphi-red) in January 2025, before the upstream v8.0.8 release. T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24010" }, "impact_statement": "not_affected \u2014 Vite 8.0.8-tuxcare.1 is NOT affected by CVE-2025-24010. All three security fixes (WebSocket token authentication, CORS restricted to loopback origins, and Host header validation) were already present in the upstream Vite v8.0.8 release (April 2026) when TuxCare onboarded it. The fixes were implemented by the upstream maintainer (sapphi-red) in January 2025, before the upstream v8.0.8 release. T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-11-06T11:26:42.233420+00:00", "status_notes": "Vulnerability CVE-2025-30208 does not affect version 8.0.8 of vite. not_affected \u2014 Vite 8.0.8 already contains the upstream fix for the trailing-separator fs allow-list bypass (CVE-2025-30208). The dev server's transform pipeline checks server.fs access with `\\b`-based regexes (`/[?&]raw\\b/`, `/[?&]url\\b/`, `/[?&]inline\\b/`) that still match `?raw??` and `?import&raw??`. The check runs before the file is loaded, so the bypass URL is denied. The fix commit is upstream-authored...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-30208" }, "impact_statement": "not_affected \u2014 Vite 8.0.8 already contains the upstream fix for the trailing-separator fs allow-list bypass (CVE-2025-30208). The dev server's transform pipeline checks server.fs access with `\\b`-based regexes (`/[?&]raw\\b/`, `/[?&]url\\b/`, `/[?&]inline\\b/`) that still match `?raw??` and `?import&raw??`. The check runs before the file is loaded, so the bypass URL is denied. The fix commit is upstream-authored..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-11-06T11:26:42.233420+00:00", "status_notes": "Vulnerability CVE-2025-31125 does not affect version 8.0.8 of vite. not_affected \u2014 Not affected. The upstream fix for CVE-2025-31125 (vitejs/vite commit 59673137, \"fix: fs check in transform middleware (#19761)\") is already in the shipped Vite 8.0.8 release. It was authored by upstream maintainer patak-dev and is in HEAD's history. transformRequest.ts and the transform middleware enforce the file-serving check on the file path with and without its query string, so a `?import&...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31125" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2025-31125 (vitejs/vite commit 59673137, \"fix: fs check in transform middleware (#19761)\") is already in the shipped Vite 8.0.8 release. It was authored by upstream maintainer patak-dev and is in HEAD's history. transformRequest.ts and the transform middleware enforce the file-serving check on the file path with and without its query string, so a `?import&..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-11-06T11:30:06.317055+00:00", "status_notes": "Vulnerability CVE-2025-31486 does not affect version 8.0.8 of vite. not_affected \u2014 Vite 8.0.8 already contains the upstream fix for CVE-2025-31486 (vitejs/vite #19782, commit 62d7e81ee, author patak-dev, first shipped in 6.2.6). The fix is in the upstream release TuxCare onboarded, so the target is not affected. It is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31486" }, "impact_statement": "not_affected \u2014 Vite 8.0.8 already contains the upstream fix for CVE-2025-31486 (vitejs/vite #19782, commit 62d7e81ee, author patak-dev, first shipped in 6.2.6). The fix is in the upstream release TuxCare onboarded, so the target is not affected. It is not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-11-06T11:33:00.046652+00:00", "status_notes": "Vulnerability CVE-2025-32395 does not affect version 8.0.8 of vite. not_affected \u2014 The target (vite 8.0.8-tuxcare.1) already contains the upstream fix for CVE-2025-32395. A middleware rejects any request whose req.url contains '#' with a 400, before any fs.deny or static handling. The fix commit 175a83909 was authored upstream and shipped in the release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32395" }, "impact_statement": "not_affected \u2014 The target (vite 8.0.8-tuxcare.1) already contains the upstream fix for CVE-2025-32395. A middleware rejects any request whose req.url contains '#' with a 400, before any fs.deny or static handling. The fix commit 175a83909 was authored upstream and shipped in the release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-11-03T23:56:43.123003+00:00", "status_notes": "Vulnerability CVE-2025-46565 does not affect version 8.0.8 of vite. not_affected \u2014 The target repository (Vite 8.0.8-tuxcare.1) is NOT vulnerable to CVE-2025-46565. The upstream fix (commit c22c43de612eebb6c182dd67850c24e4fab8cacb by green@sapphi.red) is present in HEAD and was shipped in the upstream release that TuxCare onboarded. The fix adds a shouldServe callback to sirv options that validates resolved file paths against server.fs.deny patterns AFTER path resolution, blo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46565" }, "impact_statement": "not_affected \u2014 The target repository (Vite 8.0.8-tuxcare.1) is NOT vulnerable to CVE-2025-46565. The upstream fix (commit c22c43de612eebb6c182dd67850c24e4fab8cacb by green@sapphi.red) is present in HEAD and was shipped in the upstream release that TuxCare onboarded. The fix adds a shouldServe callback to sirv options that validates resolved file paths against server.fs.deny patterns AFTER path resolution, blo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-11-04T00:09:39.314535+00:00", "status_notes": "Vulnerability CVE-2025-58751 does not affect version 8.0.8 of vite. not_affected \u2014 CVE-2025-58751 is NOT present in target version 8.0.8. The vulnerability requires sirv to use a directory path without a trailing separator, causing the startsWith() check to incorrectly match files outside the public directory (e.g., \"/www/p\" matches \"/www/private.txt\"). The target includes the upstream fix (commit 09f2b52e8d5907f26602653caf41b3a56692600d) that ensures sirv uses a trailing sep...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58751" }, "impact_statement": "not_affected \u2014 CVE-2025-58751 is NOT present in target version 8.0.8. The vulnerability requires sirv to use a directory path without a trailing separator, causing the startsWith() check to incorrectly match files outside the public directory (e.g., \"/www/p\" matches \"/www/private.txt\"). The target includes the upstream fix (commit 09f2b52e8d5907f26602653caf41b3a56692600d) that ensures sirv uses a trailing sep..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-11-04T00:13:09.120877+00:00", "status_notes": "Vulnerability CVE-2025-58752 does not affect version 8.0.8 of vite. not_affected \u2014 Target version 8.0.8 is NOT AFFECTED by CVE-2025-58752. Both security fixes (HTML file serving bypass and sourcemap handler path traversal) were already present in the upstream Vite release that TuxCare onboarded. The vulnerable pattern\u2014HTML files served without enforcing server.fs allow/deny rules\u2014does not exist in this version. Commits 14015d794 (HTML fix) and 79f002f2 (sourcemap fix) are bot...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58752" }, "impact_statement": "not_affected \u2014 Target version 8.0.8 is NOT AFFECTED by CVE-2025-58752. Both security fixes (HTML file serving bypass and sourcemap handler path traversal) were already present in the upstream Vite release that TuxCare onboarded. The vulnerable pattern\u2014HTML files served without enforcing server.fs allow/deny rules\u2014does not exist in this version. Commits 14015d794 (HTML fix) and 79f002f2 (sourcemap fix) are bot..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-11-04T00:16:00.125872+00:00", "status_notes": "Vulnerability CVE-2025-62522 does not affect version 8.0.8 of vite. not_affected \u2014 CVE-2025-62522 (trailing slash bypass of server.fs.deny) is not present in target version 8.0.8. The vulnerability allowed bypassing file deny patterns by appending trailing slashes to request paths. The fix (stripping trailing slashes before deny pattern checks) was already included in the upstream Vite 8.0.8 release that TuxCare onboarded, applied in commit f479cc57c by upstream author green@...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62522" }, "impact_statement": "not_affected \u2014 CVE-2025-62522 (trailing slash bypass of server.fs.deny) is not present in target version 8.0.8. The vulnerability allowed bypassing file deny patterns by appending trailing slashes to request paths. The fix (stripping trailing slashes before deny pattern checks) was already included in the upstream Vite 8.0.8 release that TuxCare onboarded, applied in commit f479cc57c by upstream author green@..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-10-20T19:57:00.094462+00:00", "status_notes": "Vulnerability CVE-2026-112942 affects version 8.0.8 of vite.", "vulnerability": { "name": "CVE-2026-112942" }, "action_statement": "Vulnerability CVE-2026-112942 affects version 8.0.8 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-10-20T18:59:00.099754+00:00", "status_notes": "Vulnerability CVE-2026-112943 does not affect version 8.0.8 of vite. not_affected \u2014 CVE-2026-112943 affects the launch-editor package (v2.14.1), which is a declared dependency of Vite through launch-editor-middleware@2.14.1. The vulnerable code pattern (improper % escaping on Windows when passing arguments to cmd.exe) is not present in Vite's source code itself. While Vite exposes this functionality via the /__open-in-editor endpoint, the vulnerability exists only in the exter...", "vulnerability": { "name": "CVE-2026-112943" }, "impact_statement": "not_affected \u2014 CVE-2026-112943 affects the launch-editor package (v2.14.1), which is a declared dependency of Vite through launch-editor-middleware@2.14.1. The vulnerable code pattern (improper % escaping on Windows when passing arguments to cmd.exe) is not present in Vite's source code itself. While Vite exposes this functionality via the /__open-in-editor endpoint, the vulnerability exists only in the exter..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-10-20T19:57:00.094462+00:00", "status_notes": "Vulnerability CVE-2026-112944 affects version 8.0.8 of vite.", "vulnerability": { "name": "CVE-2026-112944" }, "action_statement": "Vulnerability CVE-2026-112944 affects version 8.0.8 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-10-21T16:56:00.092611+00:00", "status_notes": "Vulnerability CVE-2026-112945 affects version 8.0.8 of vite.", "vulnerability": { "name": "CVE-2026-112945" }, "action_statement": "Vulnerability CVE-2026-112945 affects version 8.0.8 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-10-21T16:56:40.126672+00:00", "status_notes": "Vulnerability CVE-2026-112946 affects version 8.0.8 of vite.", "vulnerability": { "name": "CVE-2026-112946" }, "action_statement": "Vulnerability CVE-2026-112946 affects version 8.0.8 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-10-31T13:23:15.764405+00:00", "status_notes": "Vulnerability CVE-2026-112947 affects version 8.0.8 of vite.", "vulnerability": { "name": "CVE-2026-112947" }, "action_statement": "Vulnerability CVE-2026-112947 affects version 8.0.8 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-11-03T20:47:00.067740+00:00", "status_notes": "Vulnerability CVE-2026-118662 does not affect version 8.0.8 of vite. not_affected \u2014 The target repository (vite 8.0.8-tuxcare.1) is NOT affected by CVE-2026-118662. The vulnerability, which allowed bypassing server.fs.deny restrictions via query parameters (?raw, ?import&raw, ?import&url&inline), was fixed in upstream Vite PR #22160 (commit a9a3df2993). This fix was included in the upstream v8.0.8 release on 2026-04-09, before TuxCare onboarded the version on 2026-08-12. The f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-118662" }, "impact_statement": "not_affected \u2014 The target repository (vite 8.0.8-tuxcare.1) is NOT affected by CVE-2026-118662. The vulnerability, which allowed bypassing server.fs.deny restrictions via query parameters (?raw, ?import&raw, ?import&url&inline), was fixed in upstream Vite PR #22160 (commit a9a3df2993). This fix was included in the upstream v8.0.8 release on 2026-04-09, before TuxCare onboarded the version on 2026-08-12. The f..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-10-30T14:47:00.151806+00:00", "status_notes": "Vulnerability CVE-2026-39363 affects version 8.0.8 of vite.", "vulnerability": { "name": "CVE-2026-39363" }, "action_statement": "Vulnerability CVE-2026-39363 affects version 8.0.8 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-10-30T14:47:00.151806+00:00", "status_notes": "Vulnerability CVE-2026-39364 affects version 8.0.8 of vite.", "vulnerability": { "name": "CVE-2026-39364" }, "action_statement": "Vulnerability CVE-2026-39364 affects version 8.0.8 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-11-06T11:40:00.636701+00:00", "status_notes": "Vulnerability CVE-2026-39365 does not affect version 8.0.8 of vite. not_affected \u2014 Target (vite 8.0.8) already contains the upstream fix 79f002f22 (\"avoid path traversal with optimize deps sourcemap handler\", #22161). It was authored by green@sapphi.red and shipped in the upstream release before the first TuxCare commit. The optimized-deps .map handler now confines the resolved path to the deps cache directory before reading.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39365" }, "impact_statement": "not_affected \u2014 Target (vite 8.0.8) already contains the upstream fix 79f002f22 (\"avoid path traversal with optimize deps sourcemap handler\", #22161). It was authored by green@sapphi.red and shipped in the upstream release before the first TuxCare commit. The optimized-deps .map handler now confines the resolved path to the deps cache directory before reading." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53571 affects version 8.0.8 of vite, and is fixed in 8.0.8-tuxcare.1.", "vulnerability": { "name": "CVE-2026-53571" }, "action_statement": "Vulnerability CVE-2026-53571 affects version 8.0.8 of vite, and is fixed in 8.0.8-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@8.0.8", "identifiers": { "purl": "pkg:npm/vite@8.0.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53632 affects version 8.0.8 of vite, and is fixed in 8.0.8-tuxcare.1.", "vulnerability": { "name": "CVE-2026-53632" }, "action_statement": "Vulnerability CVE-2026-53632 affects version 8.0.8 of vite, and is fixed in 8.0.8-tuxcare.1." } ] }