This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [vite](https://vite.dev) ([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`8.3.2` → `8.3.3`](https://renovatebot.com/diffs/npm/vite/8.3.2/8.3.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vite/8.3.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/8.3.2/8.3.3?slim=true) | --- ### launch-editor: `fs.existsSync()` existence check can be bypassed on Windows [CVE-2026-112942](https://nvd.nist.gov/vuln/detail/CVE-2026-112942) / [GHSA-587h-7wmj-h5pm](https://redirect.github.com/advisories/GHSA-587h-7wmj-h5pm) <details> <summary>More information</summary> #### Details ##### Summary `launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in `\\..:line:column`. This removes the requirement that the attacker be able to place a file with a malicious filename. Combined with the `%` escaping issue described in [GHSA-698v-4r3x-3vcv](https://redirect.github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv), this bypass can lead to OS command injection when an attacker controls the file argument. ##### Impact Only apps that runs on Windows is affected. ##### Details The earlier advisory assumed that `fs.existsSync()` required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement. A crafted value ending in `\\..:1:1` is interpreted differently by `launch-editor-middleware`, `launch-editor`, and Windows: 1. `launch-editor-middleware` calls `path.resolve()` while the final path component is `..:1:1`, so it is not treated as a parent-directory component. 2. `launch-editor` treats `:1:1` as a line-and-column suffix and removes it, leaving a path ending in `\\..`. 3. On Windows, `fs.existsSync()` accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist. 4. Because the existence check passes, the crafted filename reaches the Windows shell command. #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm](https://redirect.github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm) - [https://nvd.nist.gov/vuln/detail/CVE-2026-112942](https://nvd.nist.gov/vuln/detail/CVE-2026-112942) - [https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679](https://redirect.github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679) - [https://github.com/vitejs/launch-editor](https://redirect.github.com/vitejs/launch-editor) - [https://github.com/vitejs/launch-editor/releases/tag/v2.14.2](https://redirect.github.com/vitejs/launch-editor/releases/tag/v2.14.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-587h-7wmj-h5pm) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### launch-editor: escapeCmdArgs() omits % escaping on Windows [CVE-2026-112943](https://nvd.nist.gov/vuln/detail/CVE-2026-112943) / [GHSA-698v-4r3x-3vcv](https://redirect.github.com/advisories/GHSA-698v-4r3x-3vcv) <details> <summary>More information</summary> #### Details ##### Summary `launch-editor` did not escape `%` on Windows when passing an argument to `cmd`. When an environment variable contained a malicious value, it was possible that that content to be executed. ##### Impact Only apps that match all of the following conditions are affected: - The user uses Windows - An attacker can place a file with the malicious filename containing `&` or `%` - Either of - An attacker can inject an environment variable with a malicious value - An attacker can add a NTFS alternate data stream to the file placed ##### Details Unlike `.sh` files, `.bat` / `.cmd` files on Windows cannot be called directly using [`child_process.spawn`](https://nodejs.org/docs/latest-v24.x/api/child_process.html#child_processspawncommand-args-options) and requires passing them as an argument of `cmd.exe`. To do so, launch-editor escapes the arguments passed to `cmd.exe`. But `launch-editor` did not escape `%` which is used for environment variables. Because `launch-editor` checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file. - If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set ` &calc.exe ` to `%ENV%`) and call `launchEditor` with `something%ENV%`. - If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named `~-38%calc.exe`), they can call `launchEditor` with `something %CMDCMDLINE:~-38%calc.exe`. - If the attacker can create a filename containing the `%CD%` and the subcommand (e.g. `&calc.exe `), they can call `launchEditor` with `./%CD%` #### Severity - CVSS Score: 6.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv](https://redirect.github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv) - [https://nvd.nist.gov/vuln/detail/CVE-2026-112943](https://nvd.nist.gov/vuln/detail/CVE-2026-112943) - [https://github.com/vitejs/launch-editor/pull/155](https://redirect.github.com/vitejs/launch-editor/pull/155) - [https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc](https://redirect.github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc) - [https://github.com/vitejs/launch-editor](https://redirect.github.com/vitejs/launch-editor) - [https://github.com/vitejs/launch-editor/releases/tag/v2.14.2](https://redirect.github.com/vitejs/launch-editor/releases/tag/v2.14.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-698v-4r3x-3vcv) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors [CVE-2026-112944](https://nvd.nist.gov/vuln/detail/CVE-2026-112944) / [GHSA-r825-w8mm-5pxw](https://redirect.github.com/advisories/GHSA-r825-w8mm-5pxw) <details> <summary>More information</summary> #### Details ##### Summary `launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution. ##### Impact ##### Direct `launch-editor` users Only apps that match all of the following conditions are affected: - The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory - The user uses or the app specifies any of the following editors: - Vim (including gVim) - MacVim - Emacs (including Emacsclient) - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) - The first argument of `launchEditor` can start with `+` or `-` or the user is using WSL ##### `launch-editor-middleware` users Only apps that match the following conditions are affected: - The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory - The user uses or the app specifies any of the following editors: - Vim (including gVim) - MacVim - Emacs (including Emacsclient) - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) - launch-editor older than v2.2.0 is used, or the user is using WSL ##### Vite users Only apps that match the following conditions are affected: - The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory - The user uses or the app specifies any of the following editors: - Vim (including gVim) - MacVim - Emacs (including Emacsclient) - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) - The user is using WSL ##### Details `launchEditor(file)` function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with `-` (also `+` for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with `+` as an Ex command. As a result, an existing relative directory such as: ``` +call writefile(["SAFE_MARKER"],"LAUNCH_EDITOR_MARKER")|qa! ``` is not treated as a filename when passed to Vim. Vim executes the embedded Ex command. The following editor has a potentially destructive operation exposed to the CLI arguments: - Vim (including gVim) - MacVim - Emacs (including Emacsclient) - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) `launch-editor-middleware` v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, `launch-editor` converts the paths to relative paths internally, so those are still affected. Vite 2.0.0+ uses `launch-editor-middleware` v2.2.0+ so the WSL users are only affected. #### Severity - CVSS Score: 6.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw](https://redirect.github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw) - [https://nvd.nist.gov/vuln/detail/CVE-2026-112944](https://nvd.nist.gov/vuln/detail/CVE-2026-112944) - [https://github.com/vitejs/launch-editor/pull/156](https://redirect.github.com/vitejs/launch-editor/pull/156) - [https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4](https://redirect.github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4) - [https://github.com/vitejs/launch-editor](https://redirect.github.com/vitejs/launch-editor) - [https://github.com/vitejs/launch-editor/releases/tag/v2.14.2](https://redirect.github.com/vitejs/launch-editor/releases/tag/v2.14.2) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-r825-w8mm-5pxw) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>vitejs/vite (vite)</summary> ### [`v8.3.3`](https://redirect.github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-833-2026-10-06-small) [Compare Source](https://redirect.github.com/vitejs/vite/compare/v8.3.2...v8.3.3) ##### Bug Fixes - **deps:** update launch-editor to v2.14.2 ([#23654](https://redirect.github.com/vitejs/vite/issues/23654)) ([22fd1d5](https://redirect.github.com/vitejs/vite/commit/22fd1d5238cce2ee9db0eb4122f9e8feb6b06097)) - **html:** filename passed to transformIndexHtml should not include queries ([#23653](https://redirect.github.com/vitejs/vite/issues/23653)) ([7dafd8e](https://redirect.github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17)) - **server:** check `fs.serve` for `?vite-wasm-instance` ([#23655](https://redirect.github.com/vitejs/vite/issues/23655)) ([ba8b7ab](https://redirect.github.com/vitejs/vite/commit/ba8b7ab43b4afa5d0292ab4b6e3a7b5033cc9c73)) - **server:** store ids to `safeModulePaths` rather than URLs ([#23656](https://redirect.github.com/vitejs/vite/issues/23656)) ([c3e06f9](https://redirect.github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905)) </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate).  Co-authored-by: khepri-bot[bot] <269588972+khepri-bot[bot]@users.noreply.github.com>
-Original file line number
+Diff line change
     "happy-dom": "20.14.5",
     "tailwindcss": "4.3.3",
     "typescript": "7.0.2",
 -    "vite": "8.3.2",
 +    "vite": "8.3.3",
     "vite-plugin-solid": "2.11.14",
     "vitest": "5.0.3",
     "wrangler": "4.147.0"