Gathering detailed insights and metrics for vite
Gathering detailed insights and metrics for vite
Gathering detailed insights and metrics for vite
Gathering detailed insights and metrics for vite
npm install vite
Typescript
Module System
Min. Node Version
Node Version
NPM Version
70.9
Supply Chain
66.8
Quality
96.8
Maintenance
100
Vulnerability
88.5
License
TypeScript (83.42%)
JavaScript (9.73%)
HTML (5.01%)
CSS (1.28%)
Vue (0.15%)
AppleScript (0.11%)
Svelte (0.11%)
SCSS (0.08%)
Less (0.04%)
Stylus (0.02%)
Shell (0.01%)
Pug (0.01%)
Sass (0.01%)
SugarSS (0.01%)
Total Downloads
1,117,354,102
Last Day
3,580,709
Last Week
16,643,874
Last Month
71,679,572
Last Year
713,868,361
70,357 Stars
7,488 Commits
6,397 Forks
432 Watching
48 Branches
1,067 Contributors
Latest Version
6.0.11
Package Id
vite@6.0.11
Unpacked Size
2.70 MB
Size
658.36 kB
File Count
34
NPM Version
10.8.2
Node Version
20.18.1
Publised On
21 Jan 2025
Cumulative downloads
Total Downloads
Last day
-8.1%
3,580,709
Compared to previous day
Last week
-14.8%
16,643,874
Compared to previous week
Last month
12.5%
71,679,572
Compared to previous month
Last year
126.7%
713,868,361
Compared to previous year
11
59
1
Next Generation Frontend Tooling
Vite (French word for "fast", pronounced /vit/
) is a new breed of frontend build tool that significantly improves the frontend development experience. It consists of two major parts:
A dev server that serves your source files over native ES modules, with rich built-in features and astonishingly fast Hot Module Replacement (HMR).
A build command that bundles your code with Rollup, pre-configured to output highly optimized static assets for production.
In addition, Vite is highly extensible via its Plugin API and JavaScript API with full typing support.
Stable Version
12
8.6/10
Summary
Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service
Affected Versions
>= 3.0.0-alpha.0, < 3.0.0-beta.4
Patched Versions
3.0.0-beta.4
8.6/10
Summary
Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service
Affected Versions
< 2.9.13
Patched Versions
2.9.13
7.5/10
Summary
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Affected Versions
>= 5.0.0, <= 5.0.11
Patched Versions
5.0.12
7.5/10
Summary
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Affected Versions
>= 4.0.0, <= 4.5.1
Patched Versions
4.5.2
7.5/10
Summary
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Affected Versions
>= 3.0.0, <= 3.2.7
Patched Versions
3.2.8
7.5/10
Summary
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Affected Versions
>= 2.7.0, <= 2.9.16
Patched Versions
2.9.17
7.5/10
Summary
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Affected Versions
>= 4.3.0, < 4.3.9
Patched Versions
4.3.9
7.5/10
Summary
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Affected Versions
>= 4.2.0, < 4.2.3
Patched Versions
4.2.3
7.5/10
Summary
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Affected Versions
>= 4.1.0, < 4.1.5
Patched Versions
4.1.5
7.5/10
Summary
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Affected Versions
>= 4.0.0, < 4.0.5
Patched Versions
4.0.5
7.5/10
Summary
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Affected Versions
>= 3.0.2, < 3.2.7
Patched Versions
3.2.7
7.5/10
Summary
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Affected Versions
< 2.9.16
Patched Versions
2.9.16
24
6.5/10
Summary
Websites were able to send any requests to the development server and read the response in vite
Affected Versions
<= 4.5.5
Patched Versions
4.5.6
6.5/10
Summary
Websites were able to send any requests to the development server and read the response in vite
Affected Versions
>= 5.0.0, <= 5.4.11
Patched Versions
5.4.12
6.5/10
Summary
Websites were able to send any requests to the development server and read the response in vite
Affected Versions
>= 6.0.0, <= 6.0.8
Patched Versions
6.0.9
5.3/10
Summary
Vite's `server.fs.deny` is bypassed when using `?import&raw`
Affected Versions
>= 5.0.0, <= 5.1.7
Patched Versions
5.1.8
5.3/10
Summary
Vite's `server.fs.deny` is bypassed when using `?import&raw`
Affected Versions
>= 5.2.0, < 5.2.14
Patched Versions
5.2.14
6.4/10
Summary
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
Affected Versions
>= 5.0.0, < 5.1.8
Patched Versions
5.1.8
6.4/10
Summary
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
Affected Versions
< 3.2.11
Patched Versions
3.2.11
6.4/10
Summary
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
Affected Versions
>= 5.2.0, < 5.2.14
Patched Versions
5.2.14
6.4/10
Summary
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
Affected Versions
>= 5.3.0, < 5.3.6
Patched Versions
5.3.6
6.4/10
Summary
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
Affected Versions
>= 5.4.0, < 5.4.6
Patched Versions
5.4.6
6.4/10
Summary
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
Affected Versions
>= 4.0.0, < 4.5.4
Patched Versions
4.5.4
5.3/10
Summary
Vite's `server.fs.deny` is bypassed when using `?import&raw`
Affected Versions
<= 3.2.10
Patched Versions
3.2.11
5.3/10
Summary
Vite's `server.fs.deny` is bypassed when using `?import&raw`
Affected Versions
>= 4.0.0, <= 4.5.3
Patched Versions
4.5.4
5.3/10
Summary
Vite's `server.fs.deny` is bypassed when using `?import&raw`
Affected Versions
>= 5.3.0, <= 5.3.5
Patched Versions
5.3.6
5.3/10
Summary
Vite's `server.fs.deny` is bypassed when using `?import&raw`
Affected Versions
>= 5.4.0, <= 5.4.5
Patched Versions
5.4.6
5.9/10
Summary
Vite's `server.fs.deny` did not deny requests for patterns with directories.
Affected Versions
>= 5.2.0, <= 5.2.5
Patched Versions
5.2.6
5.9/10
Summary
Vite's `server.fs.deny` did not deny requests for patterns with directories.
Affected Versions
>= 5.1.0, <= 5.1.6
Patched Versions
5.1.7
5.9/10
Summary
Vite's `server.fs.deny` did not deny requests for patterns with directories.
Affected Versions
>= 5.0.0, <= 5.0.12
Patched Versions
5.0.13
5.9/10
Summary
Vite's `server.fs.deny` did not deny requests for patterns with directories.
Affected Versions
>= 4.0.0, <= 4.5.2
Patched Versions
4.5.3
5.9/10
Summary
Vite's `server.fs.deny` did not deny requests for patterns with directories.
Affected Versions
>= 3.0.0, <= 3.2.8
Patched Versions
3.2.10
5.9/10
Summary
Vite's `server.fs.deny` did not deny requests for patterns with directories.
Affected Versions
>= 2.7.0, <= 2.9.17
Patched Versions
2.9.18
6.1/10
Summary
Vite XSS vulnerability in `server.transformIndexHtml` via URL payload
Affected Versions
>= 5.0.0, < 5.0.5
Patched Versions
5.0.5
6.1/10
Summary
Vite XSS vulnerability in `server.transformIndexHtml` via URL payload
Affected Versions
= 4.5.0
Patched Versions
4.5.1
6.1/10
Summary
Vite XSS vulnerability in `server.transformIndexHtml` via URL payload
Affected Versions
>= 4.4.0, < 4.4.12
Patched Versions
4.4.12
Reason
30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
Reason
security policy file detected
Details
Reason
Found 25/26 approved changesets -- score normalized to 9
Reason
1 existing vulnerabilities detected
Details
Reason
binaries present in source code
Details
Reason
detected GitHub workflow tokens with excessive permissions
Details
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
Reason
project is not fuzzed
Details
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
Score
Last Scanned on 2025-01-27
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More