vite-plus
1.3.0 · 16 Oct 2026MIT1.6M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for vite-plus. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 1.3.0 | Safe from 1.1.0 | |
| 0.3.3 | 3 open advisories, worst high | |
| 0.2.9 | 3 open advisories, worst high | |
| 0.1.24 | 3 open advisories, worst high | |
| 0.0.1 | 7 open advisories, worst critical · last release Jan 2022, no longer updated |
- CriticalVitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCEGHSA-g8mr-85jm-7xhm · 15 Jun 2026
- 0.1.x0.1.0 – 0.1.23Fixed in 0.1.24
- 0.0.x0.0.1No fix on 0.0.x · move to 0.1.24
- Highlaunch-editor: `fs.existsSync()` existence check can be bypassed on WindowsGHSA-587h-7wmj-h5pm · 20 Oct 2026
- 1.x1.0.0Fixed in 1.1.0
- 0.3.x0.3.0 – 0.3.3No fix on 0.3.x · move to 1.1.0
- 0.2.x0.2.0 – 0.2.9No fix on 0.2.x · move to 1.1.0
- 0.1.x0.1.0 – 0.1.24No fix on 0.1.x · move to 1.1.0
- 0.0.x0.0.1No fix on 0.0.x · move to 1.1.0
- Highvite: `server.fs.deny` bypass on Windows alternate pathsGHSA-fx2h-pf6j-xcff · 15 Jun 2026
- 0.1.x0.1.0 – 0.1.23Fixed in 0.1.24
- 0.0.x0.0.1No fix on 0.0.x · move to 0.1.24
- HighPath traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOMEGHSA-33r3-4whc-44c2 · 16 Apr 2026
- 0.1.x0.1.0 – 0.1.16Fixed in 0.1.17
- 0.0.x0.0.1No fix on 0.0.x · move to 0.1.17
- Moderatelaunch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editorsGHSA-r825-w8mm-5pxw · 20 Oct 2026
- 1.x1.0.0Fixed in 1.1.0
- 0.3.x0.3.0 – 0.3.3No fix on 0.3.x · move to 1.1.0
- 0.2.x0.2.0 – 0.2.9No fix on 0.2.x · move to 1.1.0
- 0.1.x0.1.0 – 0.1.24No fix on 0.1.x · move to 1.1.0
- 0.0.x0.0.1No fix on 0.0.x · move to 1.1.0
- Moderatelaunch-editor: escapeCmdArgs() omits % escaping on WindowsGHSA-698v-4r3x-3vcv · 20 Oct 2026
- 1.x1.0.0Fixed in 1.1.0
- 0.3.x0.3.0 – 0.3.3No fix on 0.3.x · move to 1.1.0
- 0.2.x0.2.0 – 0.2.9No fix on 0.2.x · move to 1.1.0
- 0.1.x0.1.0 – 0.1.24No fix on 0.1.x · move to 1.1.0
- 0.0.x0.0.1No fix on 0.0.x · move to 1.1.0
- Moderatelaunch-editor: NTLMv2 hash disclosure via UNC path handling on WindowsGHSA-v6wh-96g9-6wx3 · 15 Jun 2026
- 0.1.x0.1.0 – 0.1.23Fixed in 0.1.24
- 0.0.x0.0.1No fix on 0.0.x · move to 0.1.24
Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.