{ "@id": "urn:uuid:e860ea14-e90d-4745-b740-b8f9c5b2ddbd", "role": "Document Creator", "author": "https://tuxcare.com", "version": 22, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T02:45:36.676709+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2022-35204 affects version 7.2.6 of vite.", "vulnerability": { "name": "CVE-2022-35204" }, "action_statement": "Vulnerability CVE-2022-35204 affects version 7.2.6 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-11-04T04:52:00.041416+00:00", "status_notes": "Vulnerability CVE-2023-34092 affects version 7.2.6 of vite.", "vulnerability": { "name": "CVE-2023-34092" }, "action_statement": "Vulnerability CVE-2023-34092 affects version 7.2.6 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-11-14T02:45:36.676709+00:00", "status_notes": "Vulnerability CVE-2023-49293 does not affect version 7.2.6 of vite. not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2023-49293 (vitejs/vite 5b85040, \"fix: proxy html path should be encoded\"). devHtmlHook no longer URI-decodes htmlPath before building the html-proxy script src. The src is built from the still-encoded URL, so a malicious query string cannot break out of the src attribute. The fix shipped in the upstream release and no TuxCare-domain commit e...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49293" }, "impact_statement": "not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2023-49293 (vitejs/vite 5b85040, \"fix: proxy html path should be encoded\"). devHtmlHook no longer URI-decodes htmlPath before building the html-proxy script src. The src is built from the still-encoded URL, so a malicious query string cannot break out of the src attribute. The fix shipped in the upstream release and no TuxCare-domain commit e..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-11-14T01:16:35.627496+00:00", "status_notes": "Vulnerability CVE-2024-23331 does not affect version 7.2.6 of vite. not_affected \u2014 Vite 7.2.6 already contains the CVE-2024-23331 fix. The fs.deny matcher is built with picomatch nocase: true, so case-augmented paths are still denied. The fix was made upstream (PR #15653) and shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-23331" }, "impact_statement": "not_affected \u2014 Vite 7.2.6 already contains the CVE-2024-23331 fix. The fs.deny matcher is built with picomatch nocase: true, so case-augmented paths are still denied. The fix was made upstream (PR #15653) and shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-11-14T01:18:00.089817+00:00", "status_notes": "Vulnerability CVE-2024-31207 does not affect version 7.2.6 of vite. not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2024-31207. The fs.deny matcher uses matchBase:false and dot:true, and bare patterns are rewritten to **/pattern. The fix commit ba5269cc is an ancestor of HEAD, authored upstream, and shipped in the release TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-31207" }, "impact_statement": "not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2024-31207. The fs.deny matcher uses matchBase:false and dot:true, and bare patterns are rewritten to **/pattern. The fix commit ba5269cc is an ancestor of HEAD, authored upstream, and shipped in the release TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-11-14T01:18:00.089817+00:00", "status_notes": "Vulnerability CVE-2024-45811 does not affect version 7.2.6 of vite. not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2024-45811 (fix: fs raw query, #18112). The dev server transform middleware denies ?raw / ?url / ?inline / .svg requests whose resolved id is outside server.fs.allow, so the `@fs/...?import&raw` bypass does not work. The fix shipped in the upstream release and was authored by the upstream maintainer, not TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45811" }, "impact_statement": "not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2024-45811 (fix: fs raw query, #18112). The dev server transform middleware denies ?raw / ?url / ?inline / .svg requests whose resolved id is outside server.fs.allow, so the `@fs/...?import&raw` bypass does not work. The fix shipped in the upstream release and was authored by the upstream maintainer, not TuxCare." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-11-13T22:42:00.042020+00:00", "status_notes": "Vulnerability CVE-2024-45812 does not affect version 7.2.6 of vite. not_affected \u2014 Vite 7.2.6 already contains the upstream CVE-2024-45812 fix. getRelativeUrlFromDocument in packages/vite/src/node/build.ts only trusts document.currentScript.src when currentScript.tagName is SCRIPT. The fix is upstream commit ade1d8966 (#18115), which is in the upstream release history. No TuxCare/CloudLinux commit exists in HEAD's history.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45812" }, "impact_statement": "not_affected \u2014 Vite 7.2.6 already contains the upstream CVE-2024-45812 fix. getRelativeUrlFromDocument in packages/vite/src/node/build.ts only trusts document.currentScript.src when currentScript.tagName is SCRIPT. The fix is upstream commit ade1d8966 (#18115), which is in the upstream release history. No TuxCare/CloudLinux commit exists in HEAD's history." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-11-14T01:19:00.090898+00:00", "status_notes": "Vulnerability CVE-2024-52011 does not affect version 7.2.6 of vite. not_affected \u2014 Vite 7.2.6 does not contain launch-editor's vulnerable code. It only declares launch-editor-middleware ^2.12.0 as a dependency, and the lockfile resolves it to launch-editor 2.12.0. The upstream fix shipped in 2.9.0, so the resolved version is already patched.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52011" }, "impact_statement": "not_affected \u2014 Vite 7.2.6 does not contain launch-editor's vulnerable code. It only declares launch-editor-middleware ^2.12.0 as a dependency, and the lockfile resolves it to launch-editor 2.12.0. The upstream fix shipped in 2.9.0, so the resolved version is already patched." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-11-14T01:14:00.090090+00:00", "status_notes": "Vulnerability CVE-2025-24010 does not affect version 7.2.6 of vite. not_affected \u2014 Vite 7.2.6 already contains the upstream fixes for CVE-2025-24010: a localhost-only default CORS origin, Host header validation via server.allowedHosts, and a token plus host check on HMR WebSocket upgrades. The fix shipped in the upstream release, and no TuxCare-authored commit is involved.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24010" }, "impact_statement": "not_affected \u2014 Vite 7.2.6 already contains the upstream fixes for CVE-2025-24010: a localhost-only default CORS origin, Host header validation via server.allowedHosts, and a token plus host check on HMR WebSocket upgrades. The fix shipped in the upstream release, and no TuxCare-authored commit is involved." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-11-14T01:15:07.732581+00:00", "status_notes": "Vulnerability CVE-2025-30208 does not affect version 7.2.6 of vite. not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2025-30208 (#19702 \"fs raw query with query separators\", commit 262b5ec7, authored by green@sapphi.red). The fix is an ancestor of the v7.2.6 release commit, so it shipped upstream. The access-check regexes in the transform middleware use /[?&]raw\\b/, /[?&]url\\b/ and /[?&]inline\\b/, so ?raw??, ?import&raw?? and similar forms still trigger the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-30208" }, "impact_statement": "not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2025-30208 (#19702 \"fs raw query with query separators\", commit 262b5ec7, authored by green@sapphi.red). The fix is an ancestor of the v7.2.6 release commit, so it shipped upstream. The access-check regexes in the transform middleware use /[?&]raw\\b/, /[?&]url\\b/ and /[?&]inline\\b/, so ?raw??, ?import&raw?? and similar forms still trigger the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-11-14T01:16:03.937065+00:00", "status_notes": "Vulnerability CVE-2025-31125 does not affect version 7.2.6 of vite. not_affected \u2014 Target is upstream Vite 7.2.6, which already contains the upstream fix for CVE-2025-31125. The dev server's transform pipeline denies loading of non-allowed files for requests carrying raw/url/inline/svg query markers, evaluated on the id after the ?import marker is stripped. The fix commit 59673137c (upstream, author patak-dev) is an ancestor of HEAD, and HEAD has no TuxCare-domain commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31125" }, "impact_statement": "not_affected \u2014 Target is upstream Vite 7.2.6, which already contains the upstream fix for CVE-2025-31125. The dev server's transform pipeline denies loading of non-allowed files for requests carrying raw/url/inline/svg query markers, evaluated on the id after the ?import marker is stripped. The fix commit 59673137c (upstream, author patak-dev) is an ancestor of HEAD, and HEAD has no TuxCare-domain commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-11-14T01:15:07.732581+00:00", "status_notes": "Vulnerability CVE-2025-31486 does not affect version 7.2.6 of vite. not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2025-31486 (upstream commit 62d7e81ee, PR #19782). The fs access check now runs on the resolved and normalized module id inside loadAndTransform, and the id is cleaned before any file read. The fix shipped in the upstream release, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-31486" }, "impact_statement": "not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2025-31486 (upstream commit 62d7e81ee, PR #19782). The fs access check now runs on the resolved and normalized module id inside loadAndTransform, and the id is cleaned before any file read. The fix shipped in the upstream release, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-11-14T01:15:07.732581+00:00", "status_notes": "Vulnerability CVE-2025-32395 does not affect version 7.2.6 of vite. not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2025-32395. A dev-server middleware rejects any request whose req.url contains '#' with HTTP 400, before the fs.deny and static-serving middlewares run. The fix is upstream commit 175a8390 (author green@sapphi.red), which is an ancestor of HEAD. Neither the commit author nor the committer is in a TuxCare domain, and HEAD's history has no TuxC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32395" }, "impact_statement": "not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2025-32395. A dev-server middleware rejects any request whose req.url contains '#' with HTTP 400, before the fs.deny and static-serving middlewares run. The fix is upstream commit 175a8390 (author green@sapphi.red), which is an ancestor of HEAD. Neither the commit author nor the committer is in a TuxCare domain, and HEAD's history has no TuxC..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-11-14T01:16:35.627496+00:00", "status_notes": "Vulnerability CVE-2025-46565 does not affect version 7.2.6 of vite. not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2025-46565 (c22c43de, \"check static serve file inside sirv\", #19965), plus later hardening (#20968). The fix was part of the upstream release that TuxCare onboarded, so the vulnerable pattern is not present in HEAD.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-46565" }, "impact_statement": "not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2025-46565 (c22c43de, \"check static serve file inside sirv\", #19965), plus later hardening (#20968). The fix was part of the upstream release that TuxCare onboarded, so the vulnerable pattern is not present in HEAD." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-11-14T01:17:08.981647+00:00", "status_notes": "Vulnerability CVE-2025-58751 does not affect version 7.2.6 of vite. not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2025-58751. The fix is the sirv 3.0.2 upgrade (commit 09f2b52e8), whose patch makes the dev-mode root check use a trailing-separator directory prefix. A sibling path such as /www/private.txt therefore no longer passes startsWith('/www/p/'). The fix shipped inside the upstream release, so this is an upstream fix and not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58751" }, "impact_statement": "not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2025-58751. The fix is the sirv 3.0.2 upgrade (commit 09f2b52e8), whose patch makes the dev-mode root check use a trailing-separator directory prefix. A sibling path such as /www/private.txt therefore no longer passes startsWith('/www/p/'). The fix shipped inside the upstream release, so this is an upstream fix and not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-11-14T01:16:16.774695+00:00", "status_notes": "Vulnerability CVE-2025-58752 does not affect version 7.2.6 of vite. not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2025-58752. The fix is commit 14015d794 \"fix: apply fs.strict check to HTML files (#20736)\". It is an ancestor of HEAD and shipped in the upstream release. indexHtmlMiddleware now applies the server.fs allow/deny check in dev and an output-directory containment check in preview before reading any .html file. The vulnerable pattern is not pres...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58752" }, "impact_statement": "not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2025-58752. The fix is commit 14015d794 \"fix: apply fs.strict check to HTML files (#20736)\". It is an ancestor of HEAD and shipped in the upstream release. indexHtmlMiddleware now applies the server.fs allow/deny check in dev and an output-directory containment check in preview before reading any .html file. The vulnerable pattern is not pres..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-11-14T01:17:02.124086+00:00", "status_notes": "Vulnerability CVE-2025-62522 does not affect version 7.2.6 of vite. not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2025-62522 (f479cc57c, \"trim trailing slash before server.fs.deny check\"), authored by upstream maintainer green@sapphi.red. The fix shipped in the upstream v7.2.6 release. isFileLoadingAllowed strips a trailing '/' before matching fsDenyGlob, and the callers pass paths through slash(), which turns a trailing '\\' into '/'. A request for '/.en...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62522" }, "impact_statement": "not_affected \u2014 Vite 7.2.6 already contains the upstream fix for CVE-2025-62522 (f479cc57c, \"trim trailing slash before server.fs.deny check\"), authored by upstream maintainer green@sapphi.red. The fix shipped in the upstream v7.2.6 release. isFileLoadingAllowed strips a trailing '/' before matching fsDenyGlob, and the callers pass paths through slash(), which turns a trailing '\\' into '/'. A request for '/.en..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-10-20T19:57:00.094462+00:00", "status_notes": "Vulnerability CVE-2026-112942 affects version 7.2.6 of vite.", "vulnerability": { "name": "CVE-2026-112942" }, "action_statement": "Vulnerability CVE-2026-112942 affects version 7.2.6 of vite." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-11-14T01:18:21.239621+00:00", "status_notes": "Vulnerability CVE-2026-112943 does not affect version 7.2.6 of vite. not_affected \u2014 CVE-2026-112943 is in the launch-editor npm package, which escapes Windows cmd.exe arguments without escaping %. This repository is Vite 7.2.6. It does not contain launch-editor source. It only declares launch-editor-middleware ^2.12.0 as a devDependency, locked to launch-editor 2.12.0 in pnpm-lock.yaml. Vite calls the middleware at /__open-in-editor (packages/vite/src/node/server/index.ts:932)...", "vulnerability": { "name": "CVE-2026-112943" }, "impact_statement": "not_affected \u2014 CVE-2026-112943 is in the launch-editor npm package, which escapes Windows cmd.exe arguments without escaping %. This repository is Vite 7.2.6. It does not contain launch-editor source. It only declares launch-editor-middleware ^2.12.0 as a devDependency, locked to launch-editor 2.12.0 in pnpm-lock.yaml. Vite calls the middleware at /__open-in-editor (packages/vite/src/node/server/index.ts:932)..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-10-20T19:57:00.094462+00:00", "status_notes": "Vulnerability CVE-2026-112944 affects version 7.2.6 of vite.", "vulnerability": { "name": "CVE-2026-112944" }, "action_statement": "Vulnerability CVE-2026-112944 affects version 7.2.6 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-10-21T16:56:40.126672+00:00", "status_notes": "Vulnerability CVE-2026-112945 affects version 7.2.6 of vite.", "vulnerability": { "name": "CVE-2026-112945" }, "action_statement": "Vulnerability CVE-2026-112945 affects version 7.2.6 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-10-21T16:56:40.126672+00:00", "status_notes": "Vulnerability CVE-2026-112946 affects version 7.2.6 of vite.", "vulnerability": { "name": "CVE-2026-112946" }, "action_statement": "Vulnerability CVE-2026-112946 affects version 7.2.6 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-10-31T13:23:59.275184+00:00", "status_notes": "Vulnerability CVE-2026-112947 affects version 7.2.6 of vite.", "vulnerability": { "name": "CVE-2026-112947" }, "action_statement": "Vulnerability CVE-2026-112947 affects version 7.2.6 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-10-29T16:45:45.459074+00:00", "status_notes": "Vulnerability CVE-2026-118662 affects version 7.2.6 of vite.", "vulnerability": { "name": "CVE-2026-118662" }, "action_statement": "Vulnerability CVE-2026-118662 affects version 7.2.6 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-10-15T12:13:41.094671+00:00", "status_notes": "Vulnerability CVE-2026-39363 affects version 7.2.6 of vite.", "vulnerability": { "name": "CVE-2026-39363" }, "action_statement": "Vulnerability CVE-2026-39363 affects version 7.2.6 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-10-15T12:13:41.094671+00:00", "status_notes": "Vulnerability CVE-2026-39364 affects version 7.2.6 of vite.", "vulnerability": { "name": "CVE-2026-39364" }, "action_statement": "Vulnerability CVE-2026-39364 affects version 7.2.6 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-10-15T12:13:41.094671+00:00", "status_notes": "Vulnerability CVE-2026-39365 affects version 7.2.6 of vite.", "vulnerability": { "name": "CVE-2026-39365" }, "action_statement": "Vulnerability CVE-2026-39365 affects version 7.2.6 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-10-15T12:13:41.094671+00:00", "status_notes": "Vulnerability CVE-2026-53571 affects version 7.2.6 of vite.", "vulnerability": { "name": "CVE-2026-53571" }, "action_statement": "Vulnerability CVE-2026-53571 affects version 7.2.6 of vite." }, { "status": "affected", "products": [ { "@id": "pkg:npm/vite@7.2.6", "identifiers": { "purl": "pkg:npm/vite@7.2.6" } } ], "timestamp": "2026-10-22T13:38:00.476789+00:00", "status_notes": "Vulnerability CVE-2026-53632 affects version 7.2.6 of vite.", "vulnerability": { "name": "CVE-2026-53632" }, "action_statement": "Vulnerability CVE-2026-53632 affects version 7.2.6 of vite." } ] }