package

npm/vite-plus

pkg:npm/vite-plus

CRITICAL10.0npm

Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME

Modified: 5/6/2026

HIGH7.5npm

vite: `server.fs.deny` bypass on Windows alternate paths

Modified: 9/10/2026

CRITICAL9.8npm

Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

Modified: 8/13/2026

MEDIUMnpm

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

Modified: 9/10/2026