{"id":"ghsa-ghsa-9jrq-w75r-8gcw","seq":32743,"kind":"advisory","title":"Vite: Cross origin script execution through Vite custom middleware","url":"https://github.com/advisories/GHSA-9jrq-w75r-8gcw","permalink":"https://vulnpulse.app/items/ghsa-ghsa-9jrq-w75r-8gcw","summary":"影響: npm:vite >= 8.3.0, <= 8.3.2 → 8.3.3, npm:vite >= 8.2.0, <= 8.2.3 → 8.2.4, npm:vite >= 8.0.0, <= 8.1.5 → 8.1.6, npm:vite >= 7.0.0, <= 7.3.6 → 7.3.7, npm:vite <= 6.4.3 → 6.4.4, npm:vite-plus <= 1.0.0 → 1.1.0\nSummary When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server. Impact Only apps that match the following conditions are affected: - the dev server passes an unchanged browser request URL to server.transformIndexHtml: this is normally used for server.middlewareMode: true or appType: 'custom'. The internal call for appType: 'spa' and appType: 'mpa' does not match this. - the transformed HTML contains an inli…","severity":"low","techs":["nodejs"],"cves":["CVE-2026-112945"],"tags":["GHSA-9jrq-w75r-8gcw","vite","vite","vite","vite","vite","vite-plus"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T16:48:14.000Z","fetched_at":"2026-10-21T18:28:52.985Z"}