{
  "@id": "urn:uuid:a54558ca-629e-4af3-b2d7-6b8040117b30",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-15T21:35:00.382757+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.6",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.6"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-39363 does not affect version 7.3.6 of vite. CVE-2026-39363 describes a vulnerability where Vite's WebSocket `fetchModule` method bypassed `server.fs` access controls, allowing arbitrary file reads via `vite:invoke` events with `file://...?raw` URLs. The target repository (Vite v7.3.6+3) is NOT AFFECTED because the upstream vendor fix (commit 19db0f29c by \u7fe0 <green@sapphi.red>, included in v7.3.2) has already eliminated the vulnerable pattern. The fix disables `fetchModule` in the client environment (`disableFetchModule: true` in config.ts) and enforces `server.fs` validation in `transformRequest` via `isServerAccessDeniedForTransform` checks. This is an upstream vendor fix, not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-39363"
      },
      "impact_statement": "CVE-2026-39363 describes a vulnerability where Vite's WebSocket `fetchModule` method bypassed `server.fs` access controls, allowing arbitrary file reads via `vite:invoke` events with `file://...?raw` URLs. The target repository (Vite v7.3.6+3) is NOT AFFECTED because the upstream vendor fix (commit 19db0f29c by \u7fe0 <green@sapphi.red>, included in v7.3.2) has already eliminated the vulnerable pattern. The fix disables `fetchModule` in the client environment (`disableFetchModule: true` in config.ts) and enforces `server.fs` validation in `transformRequest` via `isServerAccessDeniedForTransform` checks. This is an upstream vendor fix, not a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.6",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.6"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-39364 does not affect version 7.3.6 of vite. The target repository (Vite 7.3.6) is not affected by CVE-2026-39364. The vulnerability allowed bypassing server.fs.deny restrictions by appending query parameters (?raw, ?import&raw, ?import&url&inline) to file paths, enabling access to blocked files like .env. The fix was applied by upstream Vite developers in commit f8103cc94 (part of version 7.3.2 release), which added dual permission checks on both query-stripped and original paths. Since the target version 7.3.6 > 7.3.2, it already contains this upstream vendor fix. The vulnerable code pattern is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-39364"
      },
      "impact_statement": "The target repository (Vite 7.3.6) is not affected by CVE-2026-39364. The vulnerability allowed bypassing server.fs.deny restrictions by appending query parameters (?raw, ?import&raw, ?import&url&inline) to file paths, enabling access to blocked files like .env. The fix was applied by upstream Vite developers in commit f8103cc94 (part of version 7.3.2 release), which added dual permission checks on both query-stripped and original paths. Since the target version 7.3.6 > 7.3.2, it already contains this upstream vendor fix. The vulnerable code pattern is not present in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.6",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.6"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-39365 does not affect version 7.3.6 of vite. not_affected \u2014 CVE-2026-39365 is NOT present in Vite 7.3.6. The vulnerability (path traversal in .map file requests for optimized dependencies) was fixed by upstream commit 09d8c903b authored by Vite maintainer green@sapphi.red, which was included in Vite v7.3.2 and all subsequent releases including the target version 7.3.6. The fix adds validation (`isOptimizedDepFile` check) to ensure resolved sourcemap pat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-39365"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-39365 is NOT present in Vite 7.3.6. The vulnerability (path traversal in .map file requests for optimized dependencies) was fixed by upstream commit 09d8c903b authored by Vite maintainer green@sapphi.red, which was included in Vite v7.3.2 and all subsequent releases including the target version 7.3.6. The fix adds validation (`isOptimizedDepFile` check) to ensure resolved sourcemap pat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/vite@7.3.6",
          "identifiers": {
            "purl": "pkg:npm/vite@7.3.6"
          }
        }
      ],
      "timestamp": "2026-10-15T21:35:00.382757+00:00",
      "status_notes": "Vulnerability CVE-2026-53571 does not affect version 7.3.6 of vite. The target repository (Vite v7.3.6) is not affected by CVE-2026-53571. The vulnerability, which allowed bypassing file access controls on Windows via NTFS Alternate Data Streams (e.g., `.env::$DATA`) and 8.3 short names (e.g., `ENV~1`), has been fixed by upstream Vite developers. The fix was introduced in commit 8c1855607b (part of the v7.3.5 release) and is present in the current v7.3.6 codebase. The defensive code in `packages/vite/src/node/server/middlewares/static.ts` (lines 302-313) correctly rejects file paths containing `~` (Windows 8.3 short names) and `:` after the drive letter (NTFS ADS), preventing the attack vector described in the CVE.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-53571"
      },
      "impact_statement": "The target repository (Vite v7.3.6) is not affected by CVE-2026-53571. The vulnerability, which allowed bypassing file access controls on Windows via NTFS Alternate Data Streams (e.g., `.env::$DATA`) and 8.3 short names (e.g., `ENV~1`), has been fixed by upstream Vite developers. The fix was introduced in commit 8c1855607b (part of the v7.3.5 release) and is present in the current v7.3.6 codebase. The defensive code in `packages/vite/src/node/server/middlewares/static.ts` (lines 302-313) correctly rejects file paths containing `~` (Windows 8.3 short names) and `:` after the drive letter (NTFS ADS), preventing the attack vector described in the CVE."
    }
  ]
}