Vite — CVE history (npm)

Vite

22 CVEs affect the Vite npm package (highest CVSS 8.3). 1 on CISA's Known Exploited Vulnerabilities catalog. Latest disclosed: 2026-06-22. Full CVE history sourced from NVD.

Summary

Package: Vite (npm)
Total CVEs: 22
Actively exploited (CISA KEV): 1
Highest CVSS: 8.3
Latest disclosed: 2026-06-22

Recent CVEs (top 20)

CVE	Severity	CVSS	KEV	Published	Summary
`CVE-2026-53632`	—	—	—	2026-06-22	launch-editor allows users to open files with line numbers in editor from Node.js.
`CVE-2026-53571`	High	`7.5`	—	2026-06-22	Vite is a frontend tooling framework for JavaScript.
`CVE-2024-52011`	High	`8.3`	—	2026-06-01	launch-editor allows users to open files with line numbers in editor from Node.js.
`CVE-2026-39365`	Medium	`5.3`	—	2026-04-07	Vite is a frontend tooling framework for JavaScript.
`CVE-2026-39364`	High	`7.5`	—	2026-04-07	Vite is a frontend tooling framework for JavaScript.
`CVE-2026-39363`	High	`7.5`	—	2026-04-07	Vite is a frontend tooling framework for JavaScript.
`CVE-2025-62522`	—	—	—	2025-10-20	Vite is a frontend tooling framework for JavaScript.
`CVE-2025-58752`	Medium	`5.3`	—	2025-09-08	Vite is a frontend tooling framework for JavaScript.
`CVE-2025-58751`	Medium	`5.3`	—	2025-09-08	Vite is a frontend tooling framework for JavaScript.
`CVE-2025-46565`	Medium	`5.3`	—	2025-05-01	Vite is a frontend tooling framework for javascript.
`CVE-2025-32395`	—	—	—	2025-04-10	Vite is a frontend tooling framework for javascript.
`CVE-2025-31486`	Medium	`5.3`	—	2025-04-03	Vite is a frontend tooling framework for javascript.
`CVE-2025-31125`	Medium	`5.3`	KEV	2025-03-31	Vite is a frontend tooling framework for javascript.
`CVE-2025-30208`	Medium	`5.3`	—	2025-03-24	Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10.
`CVE-2025-24010`	Medium	`6.5`	—	2025-01-20	Vite is a frontend tooling framework for javascript.
`CVE-2024-45812`	Medium	`6.4`	—	2024-09-17	Vite a frontend build tooling framework for javascript.
`CVE-2024-45811`	Medium	`4.8`	—	2024-09-17	Vite a frontend build tooling framework for javascript.
`CVE-2024-31207`	Medium	`5.9`	—	2024-04-04	Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories.
`CVE-2024-23331`	High	`7.5`	—	2024-01-19	Vite is a frontend tooling framework for javascript.
`CVE-2023-49293`	Medium	`6.1`	—	2023-12-04	Vite is a website frontend framework.

All-time worst (top 10 by CVSS)

CVE	Severity	CVSS	KEV	Published	Summary
`CVE-2024-52011`	High	`8.3`	—	2026-06-01	launch-editor allows users to open files with line numbers in editor from Node.js.
`CVE-2026-53571`	High	`7.5`	—	2026-06-22	Vite is a frontend tooling framework for JavaScript.
`CVE-2026-39364`	High	`7.5`	—	2026-04-07	Vite is a frontend tooling framework for JavaScript.
`CVE-2026-39363`	High	`7.5`	—	2026-04-07	Vite is a frontend tooling framework for JavaScript.
`CVE-2024-23331`	High	`7.5`	—	2024-01-19	Vite is a frontend tooling framework for javascript.
`CVE-2023-34092`	High	`7.5`	—	2023-06-01	Vite provides frontend tooling.
`CVE-2025-24010`	Medium	`6.5`	—	2025-01-20	Vite is a frontend tooling framework for javascript.
`CVE-2024-45812`	Medium	`6.4`	—	2024-09-17	Vite a frontend build tooling framework for javascript.
`CVE-2023-49293`	Medium	`6.1`	—	2023-12-04	Vite is a website frontend framework.
`CVE-2024-31207`	Medium	`5.9`	—	2024-04-04	Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories.

Actively exploited (CISA KEV — 1)

CVE	Severity	CVSS	KEV	Published	Summary
`CVE-2025-31125`	Medium	`5.3`	KEV	2025-03-31	Vite is a frontend tooling framework for javascript.