Repository navigation
Update dependency vite to v8.1.6 [SECURITY] - #2174
Merged
Merged
Conversation
renovate
Bot
requested review from
1egoman,
lukasIO and
xianshijing-lk
as code owners
October 21, 2026 11:31
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Contributor
size-limit report 📦
|
Contributor
|
Note that while this says "security" in the title, vite doesn't make it into the downstream krisp plugin, it's only used in the development workflow. So IMO this is good to merge but not a critical security issue that demands a new plugin release. |
1egoman
approved these changes
Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
8.1.5→8.1.6Vite Vulnerable to Path Traversal in Optimized Deps
.mapHandlingCVE-2026-39365 / GHSA-4w7w-66w2-5vf9
More information
Details
Summary
Any files ending with
.mapeven out side the project can be returned to the browser.Impact
Only apps that match the following conditions are affected:
--hostorserver.hostconfig option).mapand the path is predictableDetails
In Vite v7.3.1, the dev server’s handling of
.maprequests for optimized dependencies resolves file paths and callsreadFilewithout restricting../segments in the URL. As a result, it is possible to bypass theserver.fs.strictallow list and retrieve.mapfiles located outside the project root, provided they can be parsed as valid source map JSON.PoC
/@fsaccess is blocked bystrict(returns 403)../segments under the optimized deps.mapURL prefix to reach/tmp/poc.mapSeverity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
vite:
server.fs.denybypass on Windows alternate pathsCVE-2026-53571 / GHSA-fx2h-pf6j-xcff
More information
Details
Summary
The contents of files that are specified by
server.fs.denycan be returned to the browser on Windows.Impact
Only apps that match the following conditions are affected:
--hostorserver.hostconfig option)server.fs.allowDetails
Vite’s dev server denies direct access to sensitive files through
server.fs.deny, including entries such as.env,.env.*, and*.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied.Because of this, requests such as
/.env::$DATA?raware treated as allowed paths, while Windows resolves them to the original file's default data stream.Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them.
PoC
$ npm create vite@latest $ cd vite-project/ $ npm install $ npm run devAccess via browser at
http://localhost:5173/.env::$DATA?rawExample expected result:
/.env::$DATA?rawreturns the contents of.env/tls.pem::$DATA?rawreturns the contents oftls.pemSeverity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
CVE-2026-53632 / GHSA-v6wh-96g9-6wx3
More information
Details
Summary
The
launch-editorNPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking.Impact
If the following conditions are met, an attacker can get the NTLMv2 password hash on the computer that is using the
launch-editor:launch-editorlaunch-editoris runningThis would be a problem if the user password is too simple that it can be identified through offline hash cracking, potentially leading to further compromise of developer accounts or internal systems.
Details
launch-editoraccepts file paths without validating or restricting Windows UNC paths such as:On Windows systems, accessing a UNC path triggers an automatic NTLM authentication attempt to the remote SMB server. No user interaction or warning is required for this authentication attempt to occur.
If an attacker controls the SMB server referenced by the UNC path the victim’s NTLMv2 hash is transmitted to the attacker. The attacker can then capture the hash and perform offline password cracking. Successful cracking reveals the victim’s cleartext password.
The attacker could target a developer that uses a development server using
launch-editorto develop code locally, send them a link and grab their NTLMv2 hash.PoC
From the attacker side, we will setup an SMB server. I personally used Impacket's smbserver.py, but you could use something like Responder for this as well. For keeping it simple, we will use
smbserver.pyhere.First, let's create a directory to serve as an SMB share.
Then, start the SMB server.
Now, run any project that uses the launch-editor package. I have setup a simple "Hello world" project that uses Vite to do this. Then run the project locally (
vite).Now last, we will open a browser window and navigate to the URL used by the launch-editor package to trigger the NTLM authentication. Or we can use
curlto achieve the same.Note the IP address in the HTTP request, and make sure it connects to the IP address of the SMB server. Now we can look at the logs of
smbserver.pyand see the NTLMv2 hash coming in.Severity
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
launch-editor: escapeCmdArgs() omits % escaping on Windows
CVE-2026-112943 / GHSA-698v-4r3x-3vcv
More information
Details
Summary
launch-editordid not escape%on Windows when passing an argument tocmd. When an environment variable contained a malicious value, it was possible that that content to be executed.Impact
Only apps that match all of the following conditions are affected:
&or%Details
Unlike
.shfiles,.bat/.cmdfiles on Windows cannot be called directly usingchild_process.spawnand requires passing them as an argument ofcmd.exe. To do so, launch-editor escapes the arguments passed tocmd.exe. Butlaunch-editordid not escape%which is used for environment variables.Because
launch-editorchecks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.&calc.exeto%ENV%) and calllaunchEditorwithsomething%ENV%.~-38%calc.exe), they can calllaunchEditorwithsomething %CMDCMDLINE:~-38%calc.exe.%CD%and the subcommand (e.g.&calc.exe), they can calllaunchEditorwith./%CD%Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
launch-editor:
fs.existsSync()existence check can be bypassed on WindowsCVE-2026-112942 / GHSA-587h-7wmj-h5pm
More information
Details
Summary
launch-editorcheckedfs.existsSync(fileName)before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in\\..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename.Combined with the
%escaping issue described in GHSA-698v-4r3x-3vcv, this bypass can lead to OS command injection when an attacker controls the file argument.Impact
Only apps that runs on Windows is affected.
Details
The earlier advisory assumed that
fs.existsSync()required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement.A crafted value ending in
\\..:1:1is interpreted differently bylaunch-editor-middleware,launch-editor, and Windows:launch-editor-middlewarecallspath.resolve()while the final path component is..:1:1, so it is not treated as a parent-directory component.launch-editortreats:1:1as a line-and-column suffix and removes it, leaving a path ending in\\...fs.existsSync()accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
CVE-2026-112944 / GHSA-r825-w8mm-5pxw
More information
Details
Summary
launch-editorforwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.Impact
Direct
launch-editorusersOnly apps that match all of the following conditions are affected:
+or-in the working directorylaunchEditorcan start with+or-or the user is using WSLlaunch-editor-middlewareusersOnly apps that match the following conditions are affected:
+or-in the working directoryVite users
Only apps that match the following conditions are affected:
+or-in the working directoryDetails
launchEditor(file)function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with-(also+for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with+as an Ex command. As a result, an existing relative directory such as:is not treated as a filename when passed to Vim. Vim executes the embedded Ex command.
The following editor has a potentially destructive operation exposed to the CLI arguments:
launch-editor-middlewarev2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL,launch-editorconverts the paths to relative paths internally, so those are still affected.Vite 2.0.0+ uses
launch-editor-middlewarev2.2.0+ so the WSL users are only affected.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
vitejs/vite (vite)
v8.1.6Compare Source
Please refer to CHANGELOG.md for details.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.