CVE-2026-112945

A flaw was found in Vite. An attacker can achieve arbitrary script execution in a user's browser by convincing a victim to load a crafted development server page when an application uses custom middleware. Due to improper handling of leading slashes in request URLs during HTML transformation, the...

org.webjars.npm:launch-editor-middleware (2.2.1) potentially affected by CVE-2026-112944 via org.webjars.npm:launch-editor (2.14.1)

org.webjars.npm:launch-editor MAVEN version 2.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:launch-editor and may be impacted: - org.webjars.npm:launch-editor-middleware 2.2.1 Source cves: CVE-2026-112944 Source advisory:...

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

Summary launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution. Impact Direct launch-editor users Only apps that match all of t...

Arbitrary Argument Injection

Overview org.webjars.npm:vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Arbitrary Argument Injection via the getArgumentsForFile function in packages/launch-editor/get-args.js, where a filename is passed directly to an editor process without...

Arbitrary Argument Injection

Overview org.webjars.npm:launch-editor is a launch editor from node.js Affected versions of this package are vulnerable to Arbitrary Argument Injection via the getArgumentsForFile function in packages/launch-editor/get-args.js, where a filename is passed directly to an editor process without bein...

Arbitrary Argument Injection

Overview launch-editor is a launch editor from node.js Affected versions of this package are vulnerable to Arbitrary Argument Injection via the getArgumentsForFile function in packages/launch-editor/get-args.js, where a filename is passed directly to an editor process without being resolved to an...

Arbitrary Argument Injection

Overview vite-plus is a The Unified Toolchain for the Web Affected versions of this package are vulnerable to Arbitrary Argument Injection via the getArgumentsForFile function in packages/launch-editor/get-args.js, where a filename is passed directly to an editor process without being resolved to...

Arbitrary Argument Injection

Overview vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Arbitrary Argument Injection via the getArgumentsForFile function in packages/launch-editor/get-args.js, where a filename is passed directly to an editor process without being resolved to ...

org.webjars.npm:launch-editor-middleware (2.2.1) potentially affected by CVE-2026-112942 via org.webjars.npm:launch-editor (2.14.1)

org.webjars.npm:launch-editor MAVEN version 2.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:launch-editor and may be impacted: - org.webjars.npm:launch-editor-middleware 2.2.1 Source cves: CVE-2026-112942 Source advisory:...

org.webjars.npm:launch-editor-middleware (2.2.1) potentially affected by CVE-2026-112943 via org.webjars.npm:launch-editor (2.14.1)

org.webjars.npm:launch-editor MAVEN version 2.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:launch-editor and may be impacted: - org.webjars.npm:launch-editor-middleware 2.2.1 Source cves: CVE-2026-112943 Source advisory:...

CVE-2026-112945

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an...

CVE-2026-112942

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved whil...

CVE-2026-112945 Vite: Cross origin script execution through Vite custom middleware

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an...

CVE-2026-112945 Vite: Cross origin script execution through Vite custom middleware

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an...

CVE-2026-112945

The Vite frontend tooling framework is vulnerable to cross-origin script execution when using custom middleware. Specifically, versions prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3 may pass an unchanged browser request URL to server.transformIndexHtml. The getHtmlFilename function uses the quer...

CVE-2026-112945

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an...

EUVD-2026-105035

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved whil...

CVE-2026-112942

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved whil...

npm: Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

npm: Hono: serveStatic decodes the request path a second time, leading to bypass of middleware on static paths vulnerability discovered by ? in WordPress npm hono versions = 4.12.4, 4.13.11...

GHSA-5R4P-P66F-JHC7 Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path on...