{"schema_version":1,"title":"Vite vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 10 vulnerabilities in Vite: 0 in the last 7 days and 7 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-118662, was published on 28 October 2026. 7 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/technologies/npm-vite","json_url":"https://junglewise.ai/threats/technologies/npm-vite.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/npm-vite","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":4,"all_time":10,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":7,"last_90_days":7,"last_365_days":10},"latest":[{"cve":"CVE-2026-118662","cvss":4,"epss":0.003,"slug":"cve-2026-118662-vite-is-a-frontend-tooling-framework-for-javascript-from-6-4-4","title":"Vite development server file access bypass via query parameters","severity":"medium","exploited":false,"published_at":"2026-10-28T21:16:56.403+00:00","url":"https://junglewise.ai/threats/cve-2026-118662-vite-is-a-frontend-tooling-framework-for-javascript-from-6-4-4"},{"cve":"CVE-2026-112947","cvss":4,"epss":0.0042,"slug":"cve-2026-112947-vite-is-a-frontend-tooling-framework-for-javascript-from-8-2-0","title":"Vite information disclosure via WebAssembly query parameter","severity":"medium","exploited":false,"published_at":"2026-10-20T16:17:05.37+00:00","url":"https://junglewise.ai/threats/cve-2026-112947-vite-is-a-frontend-tooling-framework-for-javascript-from-8-2-0"},{"cve":"CVE-2026-112946","cvss":4,"epss":0.0085,"slug":"cve-2026-112946-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4","title":"Vite import analysis filesystem disclosure","severity":"medium","exploited":false,"published_at":"2026-10-20T16:17:05.21+00:00","url":"https://junglewise.ai/threats/cve-2026-112946-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4"},{"cve":"CVE-2026-112945","cvss":4,"epss":0.0047,"slug":"cve-2026-112945-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4","title":"Vite path traversal in transformIndexHtml","severity":"medium","exploited":false,"published_at":"2026-10-20T16:17:05.043+00:00","url":"https://junglewise.ai/threats/cve-2026-112945-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4"},{"cve":"CVE-2026-112944","cvss":4,"epss":0.0071,"slug":"cve-2026-112944-launch-editor-allows-users-to-open-files-with-line-numbers-in","title":"launch-editor command injection in editor invocation","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:17.793+00:00","url":"https://junglewise.ai/threats/cve-2026-112944-launch-editor-allows-users-to-open-files-with-line-numbers-in"},{"cve":"CVE-2026-112943","cvss":4,"epss":0.0041,"slug":"cve-2026-112943-launch-editor-allows-users-to-open-files-with-line-numbers-in","title":"launch-editor command injection via unescaped environment variables on Windows","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:17.643+00:00","url":"https://junglewise.ai/threats/cve-2026-112943-launch-editor-allows-users-to-open-files-with-line-numbers-in"},{"cve":"CVE-2026-112942","cvss":4,"epss":0.0133,"slug":"cve-2026-112942-launch-editor-allows-users-to-open-files-with-line-numbers-in","title":"launch-editor path traversal validation bypass on Windows","severity":"high","exploited":false,"published_at":"2026-10-20T15:17:17.23+00:00","url":"https://junglewise.ai/threats/cve-2026-112942-launch-editor-allows-users-to-open-files-with-line-numbers-in"},{"cve":"CVE-2024-52011","cvss":4,"epss":0.0051,"slug":"cve-2024-52011-vite-launch-editor-command-injection-on-windows","title":"Vite launch-editor command injection on Windows","severity":"high","exploited":false,"published_at":"2026-06-01T19:16:18.977+00:00","url":"https://junglewise.ai/threats/cve-2024-52011-vite-launch-editor-command-injection-on-windows"},{"cve":"CVE-2026-39364","cvss":7.5,"epss":0.0154,"slug":"cve-2026-39364-vite-information-disclosure-via-query-parameter-manipulation-in","title":"Vite information disclosure via query parameter manipulation in dev server","severity":"high","exploited":false,"published_at":"2026-04-07T20:16:30.17+00:00","url":"https://junglewise.ai/threats/cve-2026-39364-vite-information-disclosure-via-query-parameter-manipulation-in"},{"cve":"CVE-2026-39363","cvss":7.5,"epss":0.0262,"slug":"cve-2026-39363-vite-arbitrary-file-read-via-dev-server-websocket","title":"Vite arbitrary file read via dev server WebSocket","severity":"high","exploited":false,"published_at":"2026-04-07T20:16:30+00:00","url":"https://junglewise.ai/threats/cve-2026-39363-vite-arbitrary-file-read-via-dev-server-websocket"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Vite","slug":"npm-vite","aliases":[],"category":"package","homepage":"https://vitejs.dev/","repo_url":"https://github.com/vitejs/vite","description":"Frontend build tool that provides fast development and optimized production builds using native ES modules.","url":"https://junglewise.ai/threats/technologies/npm-vite"},"most_severe":[{"cve":"CVE-2026-39363","cvss":7.5,"epss":0.0262,"slug":"cve-2026-39363-vite-arbitrary-file-read-via-dev-server-websocket","title":"Vite arbitrary file read via dev server WebSocket","severity":"high","exploited":false,"published_at":"2026-04-07T20:16:30+00:00","url":"https://junglewise.ai/threats/cve-2026-39363-vite-arbitrary-file-read-via-dev-server-websocket"},{"cve":"CVE-2026-39364","cvss":7.5,"epss":0.0154,"slug":"cve-2026-39364-vite-information-disclosure-via-query-parameter-manipulation-in","title":"Vite information disclosure via query parameter manipulation in dev server","severity":"high","exploited":false,"published_at":"2026-04-07T20:16:30.17+00:00","url":"https://junglewise.ai/threats/cve-2026-39364-vite-information-disclosure-via-query-parameter-manipulation-in"},{"cve":"CVE-2026-112942","cvss":4,"epss":0.0133,"slug":"cve-2026-112942-launch-editor-allows-users-to-open-files-with-line-numbers-in","title":"launch-editor path traversal validation bypass on Windows","severity":"high","exploited":false,"published_at":"2026-10-20T15:17:17.23+00:00","url":"https://junglewise.ai/threats/cve-2026-112942-launch-editor-allows-users-to-open-files-with-line-numbers-in"},{"cve":"CVE-2024-52011","cvss":4,"epss":0.0051,"slug":"cve-2024-52011-vite-launch-editor-command-injection-on-windows","title":"Vite launch-editor command injection on Windows","severity":"high","exploited":false,"published_at":"2026-06-01T19:16:18.977+00:00","url":"https://junglewise.ai/threats/cve-2024-52011-vite-launch-editor-command-injection-on-windows"},{"cve":"CVE-2026-112946","cvss":4,"epss":0.0085,"slug":"cve-2026-112946-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4","title":"Vite import analysis filesystem disclosure","severity":"medium","exploited":false,"published_at":"2026-10-20T16:17:05.21+00:00","url":"https://junglewise.ai/threats/cve-2026-112946-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4"},{"cve":"CVE-2026-112944","cvss":4,"epss":0.0071,"slug":"cve-2026-112944-launch-editor-allows-users-to-open-files-with-line-numbers-in","title":"launch-editor command injection in editor invocation","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:17.793+00:00","url":"https://junglewise.ai/threats/cve-2026-112944-launch-editor-allows-users-to-open-files-with-line-numbers-in"},{"cve":"CVE-2026-112945","cvss":4,"epss":0.0047,"slug":"cve-2026-112945-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4","title":"Vite path traversal in transformIndexHtml","severity":"medium","exploited":false,"published_at":"2026-10-20T16:17:05.043+00:00","url":"https://junglewise.ai/threats/cve-2026-112945-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4"},{"cve":"CVE-2026-112947","cvss":4,"epss":0.0042,"slug":"cve-2026-112947-vite-is-a-frontend-tooling-framework-for-javascript-from-8-2-0","title":"Vite information disclosure via WebAssembly query parameter","severity":"medium","exploited":false,"published_at":"2026-10-20T16:17:05.37+00:00","url":"https://junglewise.ai/threats/cve-2026-112947-vite-is-a-frontend-tooling-framework-for-javascript-from-8-2-0"},{"cve":"CVE-2026-112943","cvss":4,"epss":0.0041,"slug":"cve-2026-112943-launch-editor-allows-users-to-open-files-with-line-numbers-in","title":"launch-editor command injection via unescaped environment variables on Windows","severity":"medium","exploited":false,"published_at":"2026-10-20T15:17:17.643+00:00","url":"https://junglewise.ai/threats/cve-2026-112943-launch-editor-allows-users-to-open-files-with-line-numbers-in"},{"cve":"CVE-2026-118662","cvss":4,"epss":0.003,"slug":"cve-2026-118662-vite-is-a-frontend-tooling-framework-for-javascript-from-6-4-4","title":"Vite development server file access bypass via query parameters","severity":"medium","exploited":false,"published_at":"2026-10-28T21:16:56.403+00:00","url":"https://junglewise.ai/threats/cve-2026-118662-vite-is-a-frontend-tooling-framework-for-javascript-from-6-4-4"}],"generated_at":"2026-11-13T03:07:00.155039+00:00"}