{ "@id": "urn:uuid:627d3d0a-3a37-4536-aed9-ec4cb4e261fb", "role": "Document Creator", "author": "https://tuxcare.com", "version": 13, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:54:11.763221+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 5.4.12 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-14T02:54:11.763221+00:00", "status_notes": "Vulnerability CVE-2023-49293 does not affect version 5.4.12 of vite. not_affected \u2014 Vite 5.4.12 is not affected. The CVE-2023-49293 flaw came from `htmlPath = decodeURI(htmlPath)` in `devHtmlHook`, added by f8868afb5 (#13581). That decoded line was then embedded unescaped in the inline-module proxy `src` attribute. Upstream fix 5b8504048 (#15223, released in 5.0.5) removed it. That fix is an ancestor of HEAD, and the line is absent from the target. The first TuxCare-domain com...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49293" }, "impact_statement": "not_affected \u2014 Vite 5.4.12 is not affected. The CVE-2023-49293 flaw came from `htmlPath = decodeURI(htmlPath)` in `devHtmlHook`, added by f8868afb5 (#13581). That decoded line was then embedded unescaped in the inline-module proxy `src` attribute. Upstream fix 5b8504048 (#15223, released in 5.0.5) removed it. That fix is an ancestor of HEAD, and the line is absent from the target. The first TuxCare-domain com..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-30T14:25:00.217895+00:00", "status_notes": "Vulnerability CVE-2024-23331 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2024-23331" }, "action_statement": "Vulnerability CVE-2024-23331 affects version 5.4.12 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-03T23:49:23.809666+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 5.4.12 of vite. not_affected \u2014 The target repository (vite 5.4.12) is not affected by CVE-2024-31207. The vulnerability\u2014caused by incorrect picomatch configuration (`matchBase: true`, missing `dot: true`) that allowed bypassing `server.fs.deny` patterns with directories\u2014was fixed in the upstream release. The fix is present in packages/vite/src/node/server/index.ts:710-722, changing `matchBase` to `false`, adding `dot: true`,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "not_affected \u2014 The target repository (vite 5.4.12) is not affected by CVE-2024-31207. The vulnerability\u2014caused by incorrect picomatch configuration (`matchBase: true`, missing `dot: true`) that allowed bypassing `server.fs.deny` patterns with directories\u2014was fixed in the upstream release. The fix is present in packages/vite/src/node/server/index.ts:710-722, changing `matchBase` to `false`, adding `dot: true`,..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-03T23:52:23.292961+00:00", "status_notes": "Vulnerability CVE-2024-45811 does not affect version 5.4.12 of vite. not_affected \u2014 The target repository (Vite v5.4.12) is not affected by CVE-2024-45811. The vulnerability pattern (processing requests with ?raw or ?url query parameters without access control validation) has been removed by an upstream fix that shipped in the v5.4.12 release. The fix (commit 6820bb3b9a) was authored by upstream Vite maintainer patak and was already present in the upstream release before TuxCa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45811" }, "impact_statement": "not_affected \u2014 The target repository (Vite v5.4.12) is not affected by CVE-2024-45811. The vulnerability pattern (processing requests with ?raw or ?url query parameters without access control validation) has been removed by an upstream fix that shipped in the v5.4.12 release. The fix (commit 6820bb3b9a) was authored by upstream Vite maintainer patak and was already present in the upstream release before TuxCa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-13T22:45:11.501462+00:00", "status_notes": "Vulnerability CVE-2024-45812 does not affect version 5.4.12 of vite. not_affected \u2014 Vite 5.4.12 already contains the upstream fix for CVE-2024-45812. getRelativeUrlFromDocument in packages/vite/src/node/build.ts now checks that document.currentScript is a SCRIPT element before using its src. The fix commit 179b17773 is by the upstream author, and it is in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45812" }, "impact_statement": "not_affected \u2014 Vite 5.4.12 already contains the upstream fix for CVE-2024-45812. getRelativeUrlFromDocument in packages/vite/src/node/build.ts now checks that document.currentScript is a SCRIPT element before using its src. The fix commit 179b17773 is by the upstream author, and it is in the upstream release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2024-52011 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2024-52011" }, "action_statement": "Vulnerability CVE-2024-52011 affects version 5.4.12 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-03T23:57:49.636936+00:00", "status_notes": "Vulnerability CVE-2025-24010 does not affect version 5.4.12 of vite. not_affected \u2014 Target version 5.4.12 is not affected by CVE-2025-24010. All three vulnerability patterns (permissive default CORS, missing WebSocket Origin validation, missing Host header validation) were fixed by upstream commits b71a5c89a, dfea38f1f, and 9da4abc8d authored by sapphi-red, which shipped in the upstream v5.4.12 release before TuxCare onboarded it. The target contains all three security defense...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24010" }, "impact_statement": "not_affected \u2014 Target version 5.4.12 is not affected by CVE-2025-24010. All three vulnerability patterns (permissive default CORS, missing WebSocket Origin validation, missing Host header validation) were fixed by upstream commits b71a5c89a, dfea38f1f, and 9da4abc8d authored by sapphi-red, which shipped in the upstream v5.4.12 release before TuxCare onboarded it. The target contains all three security defense..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2025-30208 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2025-30208" }, "action_statement": "Vulnerability CVE-2025-30208 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2025-31125 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2025-31125" }, "action_statement": "Vulnerability CVE-2025-31125 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2025-31486 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2025-31486" }, "action_statement": "Vulnerability CVE-2025-31486 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2025-32395 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2025-32395" }, "action_statement": "Vulnerability CVE-2025-32395 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2025-46565 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2025-46565" }, "action_statement": "Vulnerability CVE-2025-46565 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2025-58751 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2025-58751" }, "action_statement": "Vulnerability CVE-2025-58751 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2025-58752 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2025-58752" }, "action_statement": "Vulnerability CVE-2025-58752 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2025-62522 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2025-62522" }, "action_statement": "Vulnerability CVE-2025-62522 affects version 5.4.12 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2026-112942 does not affect version 5.4.12 of vite. not_affected \u2014 CVE-2026-112942 describes a Windows-specific path traversal bypass in the launch-editor package that allows attackers to bypass fs.existsSync() checks using crafted paths ending in \\\\..:line:column, potentially leading to OS command injection. However, Vite's codebase does not contain the vulnerable code pattern. Vite only declares launch-editor-middleware (v^2.9.1) as a dependency and delegate...", "vulnerability": { "name": "CVE-2026-112942" }, "impact_statement": "not_affected \u2014 CVE-2026-112942 describes a Windows-specific path traversal bypass in the launch-editor package that allows attackers to bypass fs.existsSync() checks using crafted paths ending in \\\\..:line:column, potentially leading to OS command injection. However, Vite's codebase does not contain the vulnerable code pattern. Vite only declares launch-editor-middleware (v^2.9.1) as a dependency and delegate..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2026-112943 does not affect version 5.4.12 of vite. not_affected \u2014 CVE-2026-112943 describes a vulnerability in the external `launch-editor` npm package (not escaping `%` on Windows when spawning `cmd.exe`). Vite v5.4.12 declares `launch-editor-middleware@2.9.1` (which depends on `launch-editor@2.9.1`) as a dependency but does NOT vendor the code. The vulnerable code pattern is not present in the Vite repository itself\u2014it exists only in the external dependency...", "vulnerability": { "name": "CVE-2026-112943" }, "impact_statement": "not_affected \u2014 CVE-2026-112943 describes a vulnerability in the external `launch-editor` npm package (not escaping `%` on Windows when spawning `cmd.exe`). Vite v5.4.12 declares `launch-editor-middleware@2.9.1` (which depends on `launch-editor@2.9.1`) as a dependency but does NOT vendor the code. The vulnerable code pattern is not present in the Vite repository itself\u2014it exists only in the external dependency..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2026-112944 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2026-112944" }, "action_statement": "Vulnerability CVE-2026-112944 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2026-112945 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2026-112945" }, "action_statement": "Vulnerability CVE-2026-112945 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2026-112946 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2026-112946" }, "action_statement": "Vulnerability CVE-2026-112946 affects version 5.4.12 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-04T02:56:20.215700+00:00", "status_notes": "Vulnerability CVE-2026-112947 does not affect version 5.4.12 of vite. not_affected \u2014 Target Vite v5.4.12-tuxcare is NOT AFFECTED by CVE-2026-112947. The vulnerability exists in code that handles the `?vite-wasm-instance` query parameter, which was introduced in commit c23d85b96 on 2026-06-11, nearly 5 months AFTER the target version was released (2025-01-20). This vulnerable feature (direct .wasm imports / WASM ESM Integration) first appears in Vite v8.1.0+. The target version ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112947" }, "impact_statement": "not_affected \u2014 Target Vite v5.4.12-tuxcare is NOT AFFECTED by CVE-2026-112947. The vulnerability exists in code that handles the `?vite-wasm-instance` query parameter, which was introduced in commit c23d85b96 on 2026-06-11, nearly 5 months AFTER the target version was released (2025-01-20). This vulnerable feature (direct .wasm imports / WASM ESM Integration) first appears in Vite v8.1.0+. The target version ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-11-03T20:51:20.505787+00:00", "status_notes": "Vulnerability CVE-2026-118662 does not affect version 5.4.12 of vite. not_affected \u2014 CVE-2026-118662 describes a server.fs.deny bypass in Vite dev server when query parameters (?raw, ?import&raw, ?import&url&inline) are used. The vulnerability pattern is NOT present in v5.4.12 because the fix (PR #18112, commit 6820bb3b9) was already included in the upstream release v5.4.6. The fix adds ensureServingAccess checks in transform middleware that strip query parameters before valida...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-118662" }, "impact_statement": "not_affected \u2014 CVE-2026-118662 describes a server.fs.deny bypass in Vite dev server when query parameters (?raw, ?import&raw, ?import&url&inline) are used. The vulnerability pattern is NOT present in v5.4.12 because the fix (PR #18112, commit 6820bb3b9) was already included in the upstream release v5.4.6. The fix adds ensureServingAccess checks in transform middleware that strip query parameters before valida..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-30T14:48:00.154664+00:00", "status_notes": "Vulnerability CVE-2026-39363 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2026-39363" }, "action_statement": "Vulnerability CVE-2026-39363 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-30T14:48:00.154664+00:00", "status_notes": "Vulnerability CVE-2026-39364 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2026-39364" }, "action_statement": "Vulnerability CVE-2026-39364 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2026-39365 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2026-39365" }, "action_statement": "Vulnerability CVE-2026-39365 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2026-53571 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2026-53571" }, "action_statement": "Vulnerability CVE-2026-53571 affects version 5.4.12 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@5.4.12", "identifiers": { "purl": "pkg:npm/vite@5.4.12" } } ], "timestamp": "2026-10-23T13:30:36.939672+00:00", "status_notes": "Vulnerability CVE-2026-53632 affects version 5.4.12 of vite.", "vulnerability": { "name": "CVE-2026-53632" }, "action_statement": "Vulnerability CVE-2026-53632 affects version 5.4.12 of vite." } ] }