@angular/build 22.2.x, 21.2.x and 20.3.x depend on vite@8.3.0 / vite@7.3.6 which are vulnerable to CVE-2026-112943

Command

serve

Is this a regression?

Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

See GHSA-698v-4r3x-3vcv (CVE-2026-112943, CVSS v4 6.3): "launch-editor: escapeCmdArgs() omits % escaping on Windows". vite bundles launch-editor into its dist, so the fix only ships with a vite bump.

Affected ranges relevant here: vite >= 8.3.0, <= 8.3.2 (patched in 8.3.3) and vite >= 7.0.0, <= 7.3.6 (patched in 7.3.7).

@angular/build pins a vulnerable version exactly on the active and both LTS branches:

v22: @angular/build 22.2.0 through 22.2.3 (latest) depend on vite@8.3.0
v21 LTS: @angular/build 21.2.18 through 21.2.27 (latest) depend on vite@7.3.6 (earlier 21.2.x pinned 7.3.1 to 7.3.5, also affected)
v20 LTS: @angular/build 20.3.31 through 20.3.40 (latest) depend on vite@7.3.6 (earlier 20.3.x pinned 7.1.2 to 7.3.5, also affected)

ng serve keeps vite's /__open-in-editor middleware, so the dev server on Windows is affected. main is already fixed (vite@8.3.4 in 22.3.0-next.2).

The fix would be:

22.2.x: approving the pending Renovate updates "build: update dependency vite to v8.3.4 (22.2.x)" and "build: update dependency rolldown to v1.2.14 (22.2.x)" on the Dependency Dashboard (Dependency Dashboard #23493), since vite 8.3.4 requires rolldown ~1.2.12 while 22.2.x pins 1.2.8
21.2.x and 20.3.x: bumping vite to 7.3.7, as was done for Vite security issue CVE-2026-53571 #33407 (fix(@angular/build): bump vite to 7.3.5 #33408 / fix(@angular/build): bump vite to 7.3.5 #33409)

Minimal Reproduction

npm view @angular/build@latest version dependencies.vite
npm view @angular/build@v21-lts version dependencies.vite
npm view @angular/build@v20-lts version dependencies.vite

Exception or Error

$ npm view @angular/build@latest version dependencies.vite
version = '22.2.3'
dependencies.vite = '8.3.0'
$ npm view @angular/build@v21-lts version dependencies.vite
version = '21.2.27'
dependencies.vite = '7.3.6'
$ npm view @angular/build@v20-lts version dependencies.vite
version = '20.3.40'
dependencies.vite = '7.3.6'

Your Environment

@angular/build    : 22.2.3 / 21.2.27 / 20.3.40
Package Manager   : npm

Anything else relevant?

npm audit does not flag this yet ("found 0 vulnerabilities" on all three versions), as the advisory was only published on 2026-10-20 and is not yet in the npm advisory feed.

The same vite releases also fix GHSA-9jrq-w75r-8gcw, GHSA-rq7h-c2jc-7f22 and GHSA-vfpm-58rq-9qcg (8.x only), which are not yet in the GitHub Advisory Database.

fix(@angular/build): bump vite to 7.3.7

Override vite package

@clydin

@clydin @alan-agius4 thanks for merging the 21.2.x and 20.3.x fixes (#34453 / #34454)! Could this issue be reopened, please? The 22.2.x line is still affected: 22.2.4, released on 2026-10-22 after the issue was closed, still pins vite@8.3.0.

$ npm view @angular/build@latest version dependencies.vite dependencies.rolldown
version = '22.2.4'
dependencies.vite = '8.3.0'
dependencies.rolldown = '1.2.8'

Now that the advisories are in the npm feed, npm audit flags it as high. Since the issue was opened, GHSA-587h-7wmj-h5pm (CVSS 7.5) and the three vite advisories have also been published:

# npm audit report

vite  8.3.0 - 8.3.2
Severity: high
launch-editor: escapeCmdArgs() omits % escaping on Windows - https://github.com/advisories/GHSA-698v-4r3x-3vcv
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors - https://github.com/advisories/GHSA-r825-w8mm-5pxw
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows - https://github.com/advisories/GHSA-587h-7wmj-h5pm
Vite: Cross origin script execution through Vite custom middleware - https://github.com/advisories/GHSA-9jrq-w75r-8gcw
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine - https://github.com/advisories/GHSA-rq7h-c2jc-7f22
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` - https://github.com/advisories/GHSA-vfpm-58rq-9qcg
fix available via `npm audit fix --force`
Will install @angular/build@22.1.9, which is a breaking change
node_modules/vite
  @angular/build  22.2.0-next.0 - 22.3.0-next.1
  Depends on vulnerable versions of vite
  node_modules/@angular/build

2 vulnerabilities (1 low, 1 high)

Both Renovate updates are still pending approval on the Dependency Dashboard (#23493): "build: update dependency vite to v8.3.5 (22.2.x)" and "build: update dependency rolldown to v1.2.15 (22.2.x)". vite 8.3.5 needs rolldown ~1.2.14, while 22.2.x pins 1.2.8. Approving both should fix it.

Yeah, +1 for reopening this as the vite version is not yet bumped in v22

Navigation Menu

Repository navigation

@angular/build 22.2.x, 21.2.x and 20.3.x depend on vite@8.3.0 / vite@7.3.6 which are vulnerable to CVE-2026-112943 #34452

Command

Is this a regression?

The previous version in which this bug was not present was

Description

Minimal Reproduction

Exception or Error

Your Environment

Anything else relevant?

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

@angular/build 22.2.x, 21.2.x and 20.3.x depend on vite@8.3.0 / vite@7.3.6 which are vulnerable to CVE-2026-112943 #34452

Description

Command

Is this a regression?

The previous version in which this bug was not present was

Description

Minimal Reproduction

Exception or Error

Your Environment

Anything else relevant?

Activity

florimond-collette commented on Oct 25, 2026

silverwing102 commented on Oct 26, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions