UBUNTU-CVE-2026-112945

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an...

EUVD-2026-105125

Vite: Cross origin script execution through Vite custom middleware...

CVE-2026-112945

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an...

CVE-2026-112945

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an...

CVE-2026-112945 Vite: Cross origin script execution through Vite custom middleware

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an...

CVE-2026-112945

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an...

CVE-2026-112945 Vite: Cross origin script execution through Vite custom middleware

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an...

CVE-2026-112945

The Vite frontend tooling framework is vulnerable to cross-origin script execution when using custom middleware. Specifically, versions prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3 may pass an unchanged browser request URL to server.transformIndexHtml. The getHtmlFilename function uses the quer...

PT-2026-118427

Name of the Vulnerable Software and Affected Versions Vite versions prior to 6.4.4 Vite versions prior to 7.3.7 Vite versions prior to 8.1.6 Vite versions prior to 8.2.4 Vite versions prior to 8.3.3 Description Applications using custom middleware are susceptible to a flaw when an unchanged brows...

Vite cross-site scripting vulnerabilities

Versions of Vite prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, as well as vite-plus prior to 1.1.0, have a cross-site scripting vulnerability. This vulnerability arises from using custom middleware, where the unchanged browser request URL is passed to server.transformIndexHtml. The...

Vite dev server - Cross-Site Scripting Detection

Vite's dev server, when used with appType: 'custom' and manually invoking server.transformIndexHtml using the unmodified request URL, is vulnerable to XSS via a crafted URL payload. If the HTML being served includes an inline module script ..., an attacker can inject a script via the URL,...

Vite XSS vulnerability in `server.transformIndexHtml` via URL payload

Summary When Vite's HTML transformation is invoked manually via server.transformIndexHtml, the original request URL is passed in unmodified, and the html being transformed contains inline module scripts ..., it is possible to inject arbitrary HTML into the transformed output by supplying a...

CVE-2023-49293 Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite

Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via server.transformIndexHtml, the original request URL is passed in unmodified, and the html being transformed contains inline module scripts ..., it is possible to inject arbitrary HTML into the transforme...

CVE-2023-49293 Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite

Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via server.transformIndexHtml, the original request URL is passed in unmodified, and the html being transformed contains inline module scripts ..., it is possible to inject arbitrary HTML into the transforme...

CVE-2023-49293

Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via "server.transformIndexHtml", the original request URL is passed in unmodified, and the "html" being transformed contains inline module scripts "...", it is possible to inject arbitrary HTML into the...

CVE-2023-49293: Improper Neutralization of Input During Web Page Generation

Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via server.transformIndexHtml, the original request URL is passed in unmodified, and the html being transformed contains inline module scripts , it is possible to inject arbitrary HTML into the transformed...