[VANTA] [VULNERABILITY] CODE_REPOSITORY <HIGH> CVE-2026-112942, CVE-2026-112943, CVE-2026-112944 and others, fix before 2026-11-20 #43

npm-vite >= 8.3.0, <= 8.3.2 dato-plugin CVE-2026-112942 HIGH remediate by: 2026-11-20T19:43:37.564Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/431

Related URLs

• GHSA-587h-7wmj-h5pm
• https://nvd.nist.gov/vuln/detail/CVE-2026-112942
• vitejs/launch-editor@f13cd83
• https://github.com/vitejs/launch-editor/releases/tag/v2.14.2
• GHSA-587h-7wmj-h5pm

npm-vite >= 8.3.0, <= 8.3.2 dato-plugin CVE-2026-112943 MEDIUM remediate by: 2026-12-20T11:47:06.005Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/430

Related URLs

• GHSA-698v-4r3x-3vcv
• https://nvd.nist.gov/vuln/detail/CVE-2026-112943
• fix: reject paths containing % on windows vitejs/launch-editor#155
• vitejs/launch-editor@3c2f9bf
• https://github.com/vitejs/launch-editor/releases/tag/v2.14.2
• GHSA-698v-4r3x-3vcv

npm-vite >= 8.3.0, <= 8.3.2 dato-plugin CVE-2026-112944 MEDIUM remediate by: 2026-12-20T19:43:37.853Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/432

Related URLs

• GHSA-r825-w8mm-5pxw
• https://nvd.nist.gov/vuln/detail/CVE-2026-112944
• fix: ensure filenames passed to editors are not considered as flags vitejs/launch-editor#156
• vitejs/launch-editor@f6e6701
• https://github.com/vitejs/launch-editor/releases/tag/v2.14.2
• GHSA-r825-w8mm-5pxw

npm-vite >= 8.3.0, <= 8.3.2 dato-plugin CVE-2026-112947 MEDIUM remediate by: 2026-12-26T03:56:39.683Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/433

Related URLs

• GHSA-vfpm-58rq-9qcg
• https://nvd.nist.gov/vuln/detail/CVE-2026-112947
• fix(server): check fs.serve for ?vite-wasm-instance vitejs/vite#23655
• vitejs/vite@b6c6d2f
• vitejs/vite@ba8b7ab
• GHSA-vfpm-58rq-9qcg

npm-vite >= 8.3.0, <= 8.3.2 dato-plugin CVE-2026-112946 MEDIUM remediate by: 2026-12-26T03:56:39.683Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/434

Related URLs

• GHSA-rq7h-c2jc-7f22
• https://nvd.nist.gov/vuln/detail/CVE-2026-112946
• fix(server): store ids to safeModulePaths rather than URLs vitejs/vite#23656
• vitejs/vite@170b927
• vitejs/vite@45c0e33
• vitejs/vite@c3e06f9
• vitejs/vite@e570d8d
• vitejs/vite@f0d76c7
• GHSA-rq7h-c2jc-7f22

npm-vite >= 8.3.0, <= 8.3.2 dato-plugin CVE-2026-112945 LOW remediate by: 2027-01-25T03:56:38.511Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/435

Related URLs

• GHSA-9jrq-w75r-8gcw
• https://nvd.nist.gov/vuln/detail/CVE-2026-112945
• fix(html): filename passed to transformIndexHtml should not include queries vitejs/vite#23653
• vitejs/vite@7dafd8e
• GHSA-9jrq-w75r-8gcw