GHSA-fx2h-pf6j-xcff
NoneCVSS
—
EPSS
—
Published
Jun 15, 2026
CISA due date
—
The record
vite: `server.fs.deny` bypass on Windows alternate paths
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | vite | 0 | 6.4.3 |
| npm | vite | 7.0.0 | 7.3.5 |
| npm | vite-plus | 0 | 0.1.24 |
Related vulnerabilities
- CVE-2026-53571 Vite is a frontend tooling framework for JavaScript. Same vulnerability
- CVE-2026-53632 launch-editor allows users to open files with line numbers in editor from Node.js. Also affects vite
- GHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows Also affects vite
- GHSA-c27g-q93r-2cwf launch-editor vulnerable to command injection via the crafted request on Windows Also affects vite
- CVE-2024-52011 launch-editor allows users to open files with line numbers in editor from Node.js. Also affects vite
- CVE-2026-39363 Vite is a frontend tooling framework for JavaScript. Also affects vite
- CVE-2026-39365 Vite is a frontend tooling framework for JavaScript. Also affects vite
- CVE-2026-39364 Vite is a frontend tooling framework for JavaScript. Also affects vite