{
  "@id": "urn:uuid:f6a4d7e4-b203-4d0b-913f-d973293e3d99",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:26:56.184488+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:25:00.217895+00:00",
      "status_notes": "Vulnerability CVE-2024-23331 affects version 7.3.2-tuxcare.1 of vite.",
      "vulnerability": {
        "name": "CVE-2024-23331"
      },
      "action_statement": "Vulnerability CVE-2024-23331 affects version 7.3.2-tuxcare.1 of vite."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:25:00.217895+00:00",
      "status_notes": "Vulnerability CVE-2024-31207 affects version 7.3.2-tuxcare.1 of vite.",
      "vulnerability": {
        "name": "CVE-2024-31207"
      },
      "action_statement": "Vulnerability CVE-2024-31207 affects version 7.3.2-tuxcare.1 of vite."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:25:00.217895+00:00",
      "status_notes": "Vulnerability CVE-2024-45811 affects version 7.3.2-tuxcare.1 of vite.",
      "vulnerability": {
        "name": "CVE-2024-45811"
      },
      "action_statement": "Vulnerability CVE-2024-45811 affects version 7.3.2-tuxcare.1 of vite."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:25:00.217895+00:00",
      "status_notes": "Vulnerability CVE-2025-24010 affects version 7.3.2-tuxcare.1 of vite.",
      "vulnerability": {
        "name": "CVE-2025-24010"
      },
      "action_statement": "Vulnerability CVE-2025-24010 affects version 7.3.2-tuxcare.1 of vite."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:25:00.217895+00:00",
      "status_notes": "Vulnerability CVE-2025-46565 affects version 7.3.2-tuxcare.1 of vite.",
      "vulnerability": {
        "name": "CVE-2025-46565"
      },
      "action_statement": "Vulnerability CVE-2025-46565 affects version 7.3.2-tuxcare.1 of vite."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:26:56.184488+00:00",
      "status_notes": "Vulnerability CVE-2025-58751 affects version 7.3.2-tuxcare.1 of vite.",
      "vulnerability": {
        "name": "CVE-2025-58751"
      },
      "action_statement": "Vulnerability CVE-2025-58751 affects version 7.3.2-tuxcare.1 of vite."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:26:56.184488+00:00",
      "status_notes": "Vulnerability CVE-2025-58752 affects version 7.3.2-tuxcare.1 of vite.",
      "vulnerability": {
        "name": "CVE-2025-58752"
      },
      "action_statement": "Vulnerability CVE-2025-58752 affects version 7.3.2-tuxcare.1 of vite."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:26:56.184488+00:00",
      "status_notes": "Vulnerability CVE-2025-62522 affects version 7.3.2-tuxcare.1 of vite.",
      "vulnerability": {
        "name": "CVE-2025-62522"
      },
      "action_statement": "Vulnerability CVE-2025-62522 affects version 7.3.2-tuxcare.1 of vite."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T19:57:00.094462+00:00",
      "status_notes": "Vulnerability CVE-2026-112942 affects version 7.3.2-tuxcare.1 of vite.",
      "vulnerability": {
        "name": "CVE-2026-112942"
      },
      "action_statement": "Vulnerability CVE-2026-112942 affects version 7.3.2-tuxcare.1 of vite."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T18:41:00.126701+00:00",
      "status_notes": "Vulnerability CVE-2026-112943 affects version 7.3.2-tuxcare.1 of vite.",
      "vulnerability": {
        "name": "CVE-2026-112943"
      },
      "action_statement": "Vulnerability CVE-2026-112943 affects version 7.3.2-tuxcare.1 of vite."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-21T09:03:00.164702+00:00",
      "status_notes": "Vulnerability CVE-2026-112944 does not affect version 7.3.2-tuxcare.1 of vite. not_affected \u2014 Vite 7.3.2-tuxcare.1 uses launch-editor-middleware@2.14.1, which includes the defense against CLI flag injection (CVE-2026-112944) by converting file paths to absolute form before passing to editors. This defense successfully prevents paths starting with `+` or `-` from being interpreted as CLI flags for non-WSL users. However, the CVE explicitly documents that WSL users remain affected because...",
      "vulnerability": {
        "name": "CVE-2026-112944"
      },
      "impact_statement": "not_affected \u2014 Vite 7.3.2-tuxcare.1 uses launch-editor-middleware@2.14.1, which includes the defense against CLI flag injection (CVE-2026-112944) by converting file paths to absolute form before passing to editors. This defense successfully prevents paths starting with `+` or `-` from being interpreted as CLI flags for non-WSL users. However, the CVE explicitly documents that WSL users remain affected because..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T11:16:24.000460+00:00",
      "status_notes": "Vulnerability CVE-2026-112945 affects version 7.3.2-tuxcare.1 of vite, and is fixed in 7.3.2-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-112945"
      },
      "action_statement": "Vulnerability CVE-2026-112945 affects version 7.3.2-tuxcare.1 of vite, and is fixed in 7.3.2-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T11:16:24.000460+00:00",
      "status_notes": "Vulnerability CVE-2026-112946 affects version 7.3.2-tuxcare.1 of vite, and is fixed in 7.3.2-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-112946"
      },
      "action_statement": "Vulnerability CVE-2026-112946 affects version 7.3.2-tuxcare.1 of vite, and is fixed in 7.3.2-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T16:45:45.459074+00:00",
      "status_notes": "Vulnerability CVE-2026-118662 affects version 7.3.2-tuxcare.1 of vite.",
      "vulnerability": {
        "name": "CVE-2026-118662"
      },
      "action_statement": "Vulnerability CVE-2026-118662 affects version 7.3.2-tuxcare.1 of vite."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-39363 does not affect version 7.3.2-tuxcare.1 of vite. The target (Vite v7.3.2) is NOT affected by CVE-2026-39363. The vulnerability\u2014whereby `fetchModule` exposed via WebSocket bypassed `server.fs` access control\u2014was fixed in upstream commit 19db0f29c (\"fix: backport #22159, apply server.fs check to env transport\") which was included in Vite v7.3.2 before release. The fix disables `fetchModule` for client (network-exposed) environments by setting `disableFetchModule: true` in config.ts and throwing an error in environment.ts when invoked. This blocks the attack path from WebSocket `vite:invoke` messages to arbitrary file content. The fix was authored by upstream Vite maintainer green@sapphi.red, not by TuxCare, so the verdict is not_affected (vendor-fix case) rather than already_fixed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-39363"
      },
      "impact_statement": "The target (Vite v7.3.2) is NOT affected by CVE-2026-39363. The vulnerability\u2014whereby `fetchModule` exposed via WebSocket bypassed `server.fs` access control\u2014was fixed in upstream commit 19db0f29c (\"fix: backport #22159, apply server.fs check to env transport\") which was included in Vite v7.3.2 before release. The fix disables `fetchModule` for client (network-exposed) environments by setting `disableFetchModule: true` in config.ts and throwing an error in environment.ts when invoked. This blocks the attack path from WebSocket `vite:invoke` messages to arbitrary file content. The fix was authored by upstream Vite maintainer green@sapphi.red, not by TuxCare, so the verdict is not_affected (vendor-fix case) rather than already_fixed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-39364 does not affect version 7.3.2-tuxcare.1 of vite. vite 7.3.2 is outside the affected version range for CVE-2026-39364 per the GitHub Security Advisory and NIST/NVD.",
      "vulnerability": {
        "name": "CVE-2026-39364"
      },
      "impact_statement": "vite 7.3.2 is outside the affected version range for CVE-2026-39364 per the GitHub Security Advisory and NIST/NVD."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-39365 does not affect version 7.3.2-tuxcare.1 of vite. not_affected \u2014 CVE-2026-39365 is NOT present in the target repository. The vulnerability describes a path traversal attack in Vite v7.3.1's optimized dependencies sourcemap handler, allowing attackers to read arbitrary .map files outside the project root by injecting ../ segments in URLs. The target is at version v7.3.2, which includes the upstream fix (commit 09d8c903b) that validates resolved paths using is...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-39365"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-39365 is NOT present in the target repository. The vulnerability describes a path traversal attack in Vite v7.3.1's optimized dependencies sourcemap handler, allowing attackers to read arbitrary .map files outside the project root by injecting ../ segments in URLs. The target is at version v7.3.2, which includes the upstream fix (commit 09d8c903b) that validates resolved paths using is..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-53571 is fixed in version 7.3.2-tuxcare.1 of vite.",
      "vulnerability": {
        "name": "CVE-2026-53571"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-53632 is fixed in version 7.3.2-tuxcare.1 of vite.",
      "vulnerability": {
        "name": "CVE-2026-53632"
      }
    }
  ]
}