Cross-site Scripting (XSS)

Overview vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Cross-site Scripting XSS via the getHtmlFilename function in packages/vite/src/node/server/middlewares/indexHtml.ts, where query strings are not stripped from the URL before the filename i...

Cross-site Scripting (XSS)

Overview vite-plus is a The Unified Toolchain for the Web Affected versions of this package are vulnerable to Cross-site Scripting XSS via the getHtmlFilename function in packages/vite/src/node/server/middlewares/indexHtml.ts, where query strings are not stripped from the URL before the filename ...

Cross-site Scripting (XSS)

Overview org.webjars.npm:vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Cross-site Scripting XSS via the getHtmlFilename function in packages/vite/src/node/server/middlewares/indexHtml.ts, where query strings are not stripped from the URL befor...

CVE-2026-112945

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an...