@angular/build 22.2.x, 21.2.x and 20.3.x depend on vite@8.3.0 / vite@7.3.6 which are vulnerable to CVE-2026-112943 #34452

Command

serve

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

See GHSA-698v-4r3x-3vcv (CVE-2026-112943, CVSS v4 6.3): "launch-editor: escapeCmdArgs() omits % escaping on Windows". vite bundles launch-editor into its dist, so the fix only ships with a vite bump.

Affected ranges relevant here: vite >= 8.3.0, <= 8.3.2 (patched in 8.3.3) and vite >= 7.0.0, <= 7.3.6 (patched in 7.3.7).

@angular/build pins a vulnerable version exactly on the active and both LTS branches:

• v22: @angular/build 22.2.0 through 22.2.3 (latest) depend on vite@8.3.0
• v21 LTS: @angular/build 21.2.18 through 21.2.27 (latest) depend on vite@7.3.6 (earlier 21.2.x pinned 7.3.1 to 7.3.5, also affected)
• v20 LTS: @angular/build 20.3.31 through 20.3.40 (latest) depend on vite@7.3.6 (earlier 20.3.x pinned 7.1.2 to 7.3.5, also affected)

ng serve keeps vite's /__open-in-editor middleware, so the dev server on Windows is affected. main is already fixed (vite@8.3.4 in 22.3.0-next.2).

The fix would be:

• 22.2.x: approving the pending Renovate updates "build: update dependency vite to v8.3.4 (22.2.x)" and "build: update dependency rolldown to v1.2.14 (22.2.x)" on the Dependency Dashboard (Dependency Dashboard #23493), since vite 8.3.4 requires rolldown ~1.2.12 while 22.2.x pins 1.2.8
• 21.2.x and 20.3.x: bumping vite to 7.3.7, as was done for Vite security issue CVE-2026-53571 #33407 (fix(@angular/build): bump vite to 7.3.5 #33408 / fix(@angular/build): bump vite to 7.3.5 #33409)

Minimal Reproduction

1. npm view @angular/build@latest version dependencies.vite
2. npm view @angular/build@v21-lts version dependencies.vite
3. npm view @angular/build@v20-lts version dependencies.vite

Exception or Error

$ npm view @angular/build@latest version dependencies.vite
version = '22.2.3'
dependencies.vite = '8.3.0'
$ npm view @angular/build@v21-lts version dependencies.vite
version = '21.2.27'
dependencies.vite = '7.3.6'
$ npm view @angular/build@v20-lts version dependencies.vite
version = '20.3.40'
dependencies.vite = '7.3.6'

Your Environment

@angular/build    : 22.2.3 / 21.2.27 / 20.3.40
Package Manager   : npm

Anything else relevant?

npm audit does not flag this yet ("found 0 vulnerabilities" on all three versions), as the advisory was only published on 2026-10-20 and is not yet in the npm advisory feed.

The same vite releases also fix GHSA-9jrq-w75r-8gcw, GHSA-rq7h-c2jc-7f22 and GHSA-vfpm-58rq-9qcg (8.x only), which are not yet in the GitHub Advisory Database.