[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vite (source)	8.2.1 → 8.2.4

---

launch-editor: escapeCmdArgs() omits % escaping on Windows

CVE-2026-112943 / GHSA-698v-4r3x-3vcv

More information

Details

Summary

launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed.

Impact

Only apps that match all of the following conditions are affected:

• The user uses Windows
• An attacker can place a file with the malicious filename containing & or %
• Either of
  • An attacker can inject an environment variable with a malicious value
  • An attacker can add a NTFS alternate data stream to the file placed

Details

Unlike .sh files, .bat / .cmd files on Windows cannot be called directly using child_process.spawn and requires passing them as an argument of cmd.exe. To do so, launch-editor escapes the arguments passed to cmd.exe. But launch-editor did not escape % which is used for environment variables.

Because launch-editor checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.

• If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set &calc.exe to %ENV%) and call launchEditor with something%ENV%.
• If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named ~-38%calc.exe), they can call launchEditor with something %CMDCMDLINE:~-38%calc.exe.
• If the attacker can create a filename containing the %CD% and the subcommand (e.g. &calc.exe ), they can call launchEditor with ./%CD%

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv
• https://nvd.nist.gov/vuln/detail/CVE-2026-112943
• https://github.com/vitejs/launch-editor/pull/155
• https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc
• https://github.com/vitejs/launch-editor/releases/tag/v2.14.2
• https://github.com/advisories/GHSA-698v-4r3x-3vcv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vitejs/vite (vite)

v8.2.4

Compare Source

Please refer to CHANGELOG.md for details.

v8.2.2

Compare Source

Features

• build: avoid settling seen preload dependencies for performance (#​23446) (e6f6b3e)
• devtools: enable dev server integration (#​23333) (68aeb8a)
• accept Rolldown watch options in server.watch (#​23133) (1b5cfe3)
• add closeServer and closePreviewServer hooks (#​23110) (e17d2d5)
• add top-level tsconfig option (#​23310) (93164c3)
• add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#​23191) (fdef04f)
• cli: support naming the CPU profile via --profile [name] (#​23042) (a500dee)
• config: warn on named imports from JSON modules (#​23378) (472385e)
• css: minify style tag (#​23183) (8156684)
• searched params attached to workers are now preserved (#​22280) (517b97f)
• support subpath imports in dynamic import statements (#​23185) (b78e2f1)
• use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#​22888) (4366ac4)
• use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#​22894) (e38f29e)
• worker: remove worker chunk if it's detected that it's not referenced (#​22473) (924997a)

Bug Fixes

• handle CRLF line endings in code frame positions (#​23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #​17467) (#​23437) (ef0dc17)
• build: keep hash placeholders as-is in resolveFileUrl hook (#​23422) (e8d6a4d)
• bundled-dev: mark payload delivered on client report (#​23373) (a6d43bc)
• deps: update all non-major dependencies (#​23445) (fc7c104)
• html: don't inline preload link targets (fix #​13355) (#​23387) (12e709c)
• resolve the actual package root in findNearestMainPackageData for nested package.json (#​23356) (8492422)
• shortcuts extend error (#​23447) (4ec58d1)
• config: close bundles when generation fails (#​23256) (6bacc95)
• css: keep newline-separated srcset candidates intact (#​23265) (4f9d2f4)
• deps: update all non-major dependencies (#​23337) (d550815)
• deps: update all non-major dependencies (#​23404) (238ad81)
• deps: update rolldown-related dependencies (#​23338) (76e8082)
• deps: update rolldown-related dependencies (#​23405) (b882566)
• dev: run closeBundle after buildEnd failure (#​23165) (8cb872e)
• hmr: handle import.meta.hot.invalidate in virtual module (#​23171) (6162968)
• utils: handle dot in srcset density descriptor (#​23346) (b50e1b4)
• utils: match timestamp query parameter with proper delimiters (#​23364) (41f3c6f)

Performance Improvements

• proxy: pre-compile context matchers at server creation (#​23263) (8abf700)

Miscellaneous Chores

• introducing @e18e/eslint-plugin (#​23357) (f794133)
• remove unnecessary comment (#​23448) (b919a1a)
• delete unused PluginContainerOptions (#​23382) (ee64401)
• use oxfmt sortImports (#​23319) (97ad042)

Code Refactoring

• delete unused esbuildPlugin (#​23381) (f40efef)
• exclude postfix from __VITE_ASSET__ (#​22886) (a6c08e1)
• remove HmrUrl concept (#​23172) (67a6807)
• use urlId of import.meta.ROLLDOWN_FILE_URL in wasm plugin (#​22962) (92bd2a7)

Tests

• add renderBuiltUrl change changes hash (#​23118) (0291408)

Beta Changelogs

8.3.0-beta.1 (2026-09-07)

See 8.3.0-beta.1 changelog

8.3.0-beta.0 (2026-09-02)

See 8.3.0-beta.0 changelog

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[netlify]

✅ Deploy Preview for solid-docs ready!

Name	Link
🔨 Latest commit	8908ea5
🔍 Latest deploy log	https://app.netlify.com/projects/solid-docs/deploys/6ad7e3e4d023b6bebafa6d0e
😎 Deploy Preview	https://deploy-preview-1663--solid-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite@​8.2.1 ⏵ 8.2.4		+19	+1	+2

View full report

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.