Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

vitejs Security Vulnerabilities | CyStack CVE Database

CVE	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-53571`Vite: `server.fs.deny` bypass on Windows alternate paths	Exploitation statusPublic exploit	FixYes	Affected productvite	Published06/22/2026	SeverityHigh
`CVE-2026-53632`NTLMv2 hash disclosure via UNC path handling on Windows	Exploitation statusPublic exploit	FixYes	Affected productlaunch-editor	Published06/22/2026	SeverityMedium
`CVE-2024-52011`launch-editor vulnerable to command injection via the crafted request on Windows	Exploitation statusNot known exploited	FixYes	Affected productlaunch-editor	Published06/01/2026	SeverityHigh
`CVE-2026-39365`Vite has a Path Traversal in Optimized Deps `.map` Handling	Exploitation statusPublic exploit	FixYes	Affected productvite	Published04/07/2026	SeverityMedium
`CVE-2026-39364`Vite has a `server.fs.deny` bypass with queries	Exploitation statusPublic exploit	FixYes	Affected productvite	Published04/07/2026	SeverityHigh
`CVE-2026-39363`Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket	Exploitation statusPublic exploit	FixYes	Affected productvite	Published04/07/2026	SeverityHigh
`CVE-2025-68155`@vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development	Exploitation statusPublic exploit	FixNot confirmed	Affected productvite-plugin-react	Published12/16/2025	SeverityHigh
`CVE-2025-67489`@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server	Exploitation statusPublic exploit	FixYes	Affected productvite-plugin-react	Published12/09/2025	SeverityCritical
`CVE-2025-62522`vite allows server.fs.deny bypass via backslash on Windows	Exploitation statusPublic exploit	FixYes	Affected productvite	Published10/20/2025	SeverityMedium
`CVE-2025-58752`Vite's `server.fs` settings were not applied to HTML files	Exploitation statusPublic exploit	FixNot confirmed	Affected productvite	Published09/08/2025	SeverityLow
`CVE-2025-58751`Vite middleware may serve files starting with the same name with the public directory	Exploitation statusPublic exploit	FixNot confirmed	Affected productvite	Published09/08/2025	SeverityLow
`CVE-2025-46565`Vite's server.fs.deny bypassed with /. for files under project root	Exploitation statusPublic exploit	FixYes	Affected productvite	Published05/01/2025	SeverityMedium
`CVE-2025-32395`Vite has an `server.fs.deny` bypass with an invalid `request-target`	Exploitation statusPublic exploit	FixYes	Affected productvite	Published04/10/2025	SeverityMedium
`CVE-2025-31486`Vite allows server.fs.deny to be bypassed with .svg or relative paths	Exploitation statusPublic exploit	FixYes	Affected productvite	Published04/03/2025	SeverityMedium
`CVE-2025-31125`Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query	Exploitation statusKEV	FixYes	Affected productvite	Published03/31/2025	SeverityMedium
`CVE-2025-30208`Vite bypasses server.fs.deny when using `?raw??`	Exploitation statusPublic exploit	FixNot confirmed	Affected productvite	Published03/24/2025	SeverityMedium
`CVE-2025-24010`Vite allows any websites to send any requests to the development server and read the response	Exploitation statusPublic exploit	FixYes	Affected productvite	Published01/20/2025	SeverityMedium
`CVE-2024-45812`DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite	Exploitation statusPublic exploit	FixYes	Affected productvite	Published09/17/2024	SeverityMedium
`CVE-2024-45811`server.fs.deny bypassed when using ?import&raw in vite	Exploitation statusPublic exploit	FixYes	Affected productvite	Published09/17/2024	SeverityMedium
`CVE-2024-31207`Vite's `server.fs.deny` did not deny requests for patterns with directories	Exploitation statusNot known exploited	FixYes	Affected productvite	Published04/04/2024	SeverityMedium
`CVE-2024-23331`Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem	Exploitation statusPublic exploit	FixNot confirmed	Affected productvite	Published01/19/2024	SeverityHigh
`CVE-2023-49293`Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite	Exploitation statusNot known exploited	FixNot confirmed	Affected productvite	Published12/04/2023	SeverityMedium
`CVE-2023-34092`Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)	Exploitation statusPublic exploit	FixYes	Affected productvite	Published06/01/2023	SeverityHigh
`CVE-2022-35204`CVE-2022-35204	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published08/18/2022	SeverityUnknown

24 / 24 Results

All vulnerabilities loaded

Security vulnerabilities from vitejs

vitejs

Verify to analyze this security profile

How many security vulnerabilities does vitejs have?

Which vitejs product has the most security vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management

Popular vitejs products

vite

vite-plus

launch-editor

vite-plugin-react