{"action":"Upgrade vite to 4.5.14 or later.","affected":[{"fixed":"6.3.4","introduced":"6.3.0"},{"fixed":"6.2.7","introduced":"6.2.0"},{"fixed":"6.1.6","introduced":"6.0.0"},{"fixed":"5.4.19","introduced":"5.0.0"},{"fixed":"4.5.14","introduced":"0"}],"component":"vite","cve_ids":["CVE-2025-46565"],"ecosystem":"npm","epss":0.01243,"exploited":false,"fixed_versions":["6.3.4","6.2.7","6.1.6","5.4.19","4.5.14"],"ghsa_id":"GHSA-859w-5945-r5v3","id":"tcs_01M5KFBV8KHDT5KCZD3JJJXNTH","modified_at":"2026-09-10T03:50:23.700922294Z","published_at":"2025-04-30T17:40:27Z","references":["https://osv.dev/vulnerability/GHSA-859w-5945-r5v3","https://github.com/vitejs/vite/security/advisories/GHSA-859w-5945-r5v3","https://nvd.nist.gov/vuln/detail/CVE-2025-46565","https://github.com/vitejs/vite/commit/c22c43de612eebb6c182dd67850c24e4fab8cacb","https://github.com/vitejs/vite"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-859w-5945-r5v3","url":"https://osv.dev/vulnerability/GHSA-859w-5945-r5v3"},{"source":"nvd","source_id":"CVE-2025-46565","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46565"}],"summary":"Vite's server.fs.deny bypassed with /. for files under project root"}