[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
vite (source)	8.3.0 → 8.3.3

---

launch-editor: escapeCmdArgs() omits % escaping on Windows

CVE-2026-112943 / GHSA-698v-4r3x-3vcv

More information

Details

Summary

launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed.

Impact

Only apps that match all of the following conditions are affected:

• The user uses Windows
• An attacker can place a file with the malicious filename containing & or %
• Either of
  • An attacker can inject an environment variable with a malicious value
  • An attacker can add a NTFS alternate data stream to the file placed

Details

Unlike .sh files, .bat / .cmd files on Windows cannot be called directly using child_process.spawn and requires passing them as an argument of cmd.exe. To do so, launch-editor escapes the arguments passed to cmd.exe. But launch-editor did not escape % which is used for environment variables.

Because launch-editor checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.

• If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set &calc.exe to %ENV%) and call launchEditor with something%ENV%.
• If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named ~-38%calc.exe), they can call launchEditor with something %CMDCMDLINE:~-38%calc.exe.
• If the attacker can create a filename containing the %CD% and the subcommand (e.g. &calc.exe ), they can call launchEditor with ./%CD%

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv
• https://nvd.nist.gov/vuln/detail/CVE-2026-112943
• https://github.com/vitejs/launch-editor/pull/155
• https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc
• https://github.com/vitejs/launch-editor/releases/tag/v2.14.2
• https://github.com/advisories/GHSA-698v-4r3x-3vcv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vitejs/vite (vite)

v8.3.3

Compare Source

Bug Fixes

• deps: update launch-editor to v2.14.2 (#​23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#​23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#​23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#​23656) (c3e06f9)

v8.3.2

Compare Source

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#​23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#​23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#​23568) (bc598a6)
• deps: update all non-major dependencies (#​23601) (9944fa6)
• deps: update rolldown-related dependencies (#​23602) (88c1741)
• html: resolve percent-encoded srcset urls (#​23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#​23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#​23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#​23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#​23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#​23586) (744269e)
• server: handle file watcher errors without crashing (#​23503) (6894f5c)
• server: release previous environments after initialization (#​23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#​23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#​23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#​23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#​23510) (cf5c028)
• only register time middleware when debug logging is enabled (#​23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#​23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#​23604) (24339f4)

Code Refactoring

• use tinyexec instead of cross-spawn (#​23583) (db915e5)

Tests

• bundled-dev: accept a rolldown dev runtime with no helper imports (#​23606) (634745d)

v8.3.1

Compare Source

Bug Fixes

• deps: update all non-major dependencies (#​23482) (3c752c8)
• deps: update all non-major dependencies (#​23537) (e8990c4)
• deps: update rolldown-related dependencies (#​23483) (9aecbbf)
• handle server.ws: false in mergeConfig (#​23511) (f68c0d5)
• merge build.rolldownOptions.output.comments correctly (#​23514) (4aba8d8)
• optimizer: don't skip imports whose binding starts with type (#​23540) (39330f4)
• optimizer: resolve pending discovered dep processing on close before init (#​23567) (5f89433)
• server: avoid reinitializing watcher when adding file after server close (#​23572) (6f831f9)
• sourcemap: skip URL source roots when injecting sources content (#​23519) (04fc30a)

Miscellaneous Chores

• merge prereleases in changelog (#​23466) (99bd9d1)
• optimizer: add debug log when waiting for dep before init (#​23566) (63567c7)
• update optimizeDeps.include comment (#​23489) (6a84c72)

Code Refactoring

• assets regexp use non-capture (#​23491) (f4b4431)
• remove duplicate configurations (#​23532) (9abd99b)
• replace find with some (#​23554) (af7cdf6)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Size Change: 0 B

Total Size: 36.3 kB

ℹ️ View Unchanged

Filename	Size
dist/_virtual/_rolldown/runtime.js	355 B
dist/angular-parser.js	2.66 kB
dist/ast-transform/ast-transformer.js	273 B
dist/ast-transform/index.js	378 B
dist/ast-transform/node-transformer.js	1.23 kB
dist/ast-transform/node-types.d.ts	987 B
dist/ast-transform/transforms/index.js	3.79 kB
dist/ast-transform/transforms/transform-array-expression.js	253 B
dist/ast-transform/transforms/transform-arrow-function-expression.js	515 B
dist/ast-transform/transforms/transform-ast-with-source.js	200 B
dist/ast-transform/transforms/transform-binary-expression.js	710 B
dist/ast-transform/transforms/transform-call-expression.js	773 B
dist/ast-transform/transforms/transform-chained-expression.js	248 B
dist/ast-transform/transforms/transform-conditional-expression.js	377 B
dist/ast-transform/transforms/transform-empty-expression.js	171 B
dist/ast-transform/transforms/transform-interpolation.js	360 B
dist/ast-transform/transforms/transform-literal.js	802 B
dist/ast-transform/transforms/transform-member-expression.js	1.63 kB
dist/ast-transform/transforms/transform-non-null-expression.js	260 B
dist/ast-transform/transforms/transform-object-expression.js	1.09 kB
dist/ast-transform/transforms/transform-parenthesized-expression.js	236 B
dist/ast-transform/transforms/transform-pipe-expression.js	365 B
dist/ast-transform/transforms/transform-spread-element.js	247 B
dist/ast-transform/transforms/transform-template-literal.js	1.12 kB
dist/ast-transform/transforms/transform-this-expression.js	173 B
dist/ast-transform/transforms/transform-unary-expression.js	696 B
dist/ast-transform/transforms/transform-unexpected-node.js	317 B
dist/ast-transform/visitor-keys.js	228 B
dist/ast-transform/visitors.js	189 B
dist/estree-parser.d.ts	682 B
dist/estree-parser.js	1.1 kB
dist/index.d.ts	387 B
dist/index.js	310 B
dist/microsyntax/microsyntax-node-types.d.ts	1.6 kB
dist/microsyntax/transform-template-binding.js	6.03 kB
dist/microsyntax/visitor-keys.js	330 B
dist/source.js	1.39 kB
dist/types.d.ts	1.34 kB
dist/utilities.js	1.32 kB
dist/visitor-keys.d.ts	861 B
dist/visitor-keys.js	287 B

_{compressed-size-action}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/angular-estree-parser@425

commit: 8e41e09