Update dependency vite to v6.4.4 [SECURITY] #12
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/npm-vite-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
6.4.3→6.4.4launch-editor:
fs.existsSync()existence check can be bypassed on WindowsCVE-2026-112942 / GHSA-587h-7wmj-h5pm
More information
Details
Summary
launch-editorcheckedfs.existsSync(fileName)before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in\\..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename.Combined with the
%escaping issue described in GHSA-698v-4r3x-3vcv, this bypass can lead to OS command injection when an attacker controls the file argument.Impact
Only apps that runs on Windows is affected.
Details
The earlier advisory assumed that
fs.existsSync()required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement.A crafted value ending in
\\..:1:1is interpreted differently bylaunch-editor-middleware,launch-editor, and Windows:launch-editor-middlewarecallspath.resolve()while the final path component is..:1:1, so it is not treated as a parent-directory component.launch-editortreats:1:1as a line-and-column suffix and removes it, leaving a path ending in\\...fs.existsSync()accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
launch-editor: escapeCmdArgs() omits % escaping on Windows
CVE-2026-112943 / GHSA-698v-4r3x-3vcv
More information
Details
Summary
launch-editordid not escape%on Windows when passing an argument tocmd. When an environment variable contained a malicious value, it was possible that that content to be executed.Impact
Only apps that match all of the following conditions are affected:
&or%Details
Unlike
.shfiles,.bat/.cmdfiles on Windows cannot be called directly usingchild_process.spawnand requires passing them as an argument ofcmd.exe. To do so, launch-editor escapes the arguments passed tocmd.exe. Butlaunch-editordid not escape%which is used for environment variables.Because
launch-editorchecks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.&calc.exeto%ENV%) and calllaunchEditorwithsomething%ENV%.~-38%calc.exe), they can calllaunchEditorwithsomething %CMDCMDLINE:~-38%calc.exe.%CD%and the subcommand (e.g.&calc.exe), they can calllaunchEditorwith./%CD%Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
CVE-2026-112944 / GHSA-r825-w8mm-5pxw
More information
Details
Summary
launch-editorforwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.Impact
Direct
launch-editorusersOnly apps that match all of the following conditions are affected:
+or-in the working directorylaunchEditorcan start with+or-or the user is using WSLlaunch-editor-middlewareusersOnly apps that match the following conditions are affected:
+or-in the working directoryVite users
Only apps that match the following conditions are affected:
+or-in the working directoryDetails
launchEditor(file)function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with-(also+for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with+as an Ex command. As a result, an existing relative directory such as:is not treated as a filename when passed to Vim. Vim executes the embedded Ex command.
The following editor has a potentially destructive operation exposed to the CLI arguments:
launch-editor-middlewarev2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL,launch-editorconverts the paths to relative paths internally, so those are still affected.Vite 2.0.0+ uses
launch-editor-middlewarev2.2.0+ so the WSL users are only affected.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
vitejs/vite (vite)
v6.4.4Compare Source
Please refer to CHANGELOG.md for details.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.