[VANTA] [VULNERABILITY] CODE_REPOSITORY <CRITICAL> CVE-2026-102422, CVE-2026-111755, CVE-2026-111756 and others, fix before 2026-11-08

Important

CLOSE THE ISSUE ONLY IF YOU PLAN TO DEPLOY THE FIX BEFORE THE DEADLINE IN THE TITLE.

DO NOT MANUALLY MODIFY THE ISSUE TITLE OR TEXT BODY.

npm-next >= 16.2.0, < 16.3.6 examples GHSA-vcvr-r3jv-pc5j CRITICAL remediate by: 2026-11-08T11:48:44.898Z

https://github.com/commercelayer/examples/security/dependabot/1153

Related URLs

GHSA-vcvr-r3jv-pc5j

GHSA-wx4j-mvgx-mqwp

vercel/next.js@868fad3

https://github.com/vercel/next.js/releases/tag/v16.3.6

GHSA-vcvr-r3jv-pc5j

npm-shell-quote >= 1.8.4, < 1.11.0 examples CVE-2026-102422 CRITICAL remediate by: 2026-11-13T03:49:45.355Z

https://github.com/commercelayer/examples/security/dependabot/1155

Related URLs

GHSA-pqg4-j6r4-53mv

https://nvd.nist.gov/vuln/detail/CVE-2026-102422

ljharb/shell-quote@6002b2e

GHSA-pqg4-j6r4-53mv

npm-next >= 16.0.0, < 16.3.8 examples CVE-2026-94483 HIGH remediate by: 2026-11-15T17:14:20.235Z

https://github.com/commercelayer/examples/security/dependabot/1162

Related URLs

GHSA-cjq9-62q9-8jv4

https://nvd.nist.gov/vuln/detail/CVE-2026-94483

vercel/next.js@e002ad6

https://github.com/vercel/next.js/releases/tag/v16.3.8

GHSA-cjq9-62q9-8jv4

npm-next >= 16.0.0, < 16.3.8 examples CVE-2026-94543 MEDIUM remediate by: 2026-12-15T17:14:20.483Z

https://github.com/commercelayer/examples/security/dependabot/1165

Related URLs

GHSA-4jqv-mc3x-m676

https://nvd.nist.gov/vuln/detail/CVE-2026-94543

vercel/next.js@52c94ab

vercel/next.js@719e4c6

https://github.com/vercel/next.js/releases/tag/v15.5.27

https://github.com/vercel/next.js/releases/tag/v16.3.8

GHSA-4jqv-mc3x-m676

npm-next >= 16.0.0, < 16.3.8 examples CVE-2026-94485 MEDIUM remediate by: 2026-12-15T17:14:20.483Z

https://github.com/commercelayer/examples/security/dependabot/1168

Related URLs

GHSA-f87g-xv8r-7p7x

https://nvd.nist.gov/vuln/detail/CVE-2026-94485

vercel/next.js@2d9f50a

https://github.com/vercel/next.js/releases/tag/v16.3.8

GHSA-f87g-xv8r-7p7x

npm-next >= 16.0.0, < 16.3.8 examples CVE-2026-94486 LOW remediate by: 2027-01-14T17:14:20.695Z

https://github.com/commercelayer/examples/security/dependabot/1171

Related URLs

GHSA-39w2-rjm5-chcv

https://nvd.nist.gov/vuln/detail/CVE-2026-94486

vercel/next.js@2d9f50a

https://github.com/vercel/next.js/releases/tag/v16.3.8

GHSA-39w2-rjm5-chcv

npm-vite >= 8.3.0, <= 8.3.2 examples CVE-2026-112942 HIGH remediate by: 2026-11-20T03:49:41.747Z

https://github.com/commercelayer/examples/security/dependabot/1182

Related URLs

GHSA-587h-7wmj-h5pm

https://nvd.nist.gov/vuln/detail/CVE-2026-112942

vitejs/launch-editor@f13cd83

https://github.com/vitejs/launch-editor/releases/tag/v2.14.2

GHSA-587h-7wmj-h5pm

npm-vite >= 8.3.0, <= 8.3.2 examples CVE-2026-112943 MEDIUM remediate by: 2026-12-20T03:49:42.036Z

https://github.com/commercelayer/examples/security/dependabot/1181

Related URLs

GHSA-698v-4r3x-3vcv

https://nvd.nist.gov/vuln/detail/CVE-2026-112943

fix: reject paths containing % on windows vitejs/launch-editor#155

vitejs/launch-editor@3c2f9bf

https://github.com/vitejs/launch-editor/releases/tag/v2.14.2

GHSA-698v-4r3x-3vcv

npm-vite >= 8.3.0, <= 8.3.2 examples CVE-2026-112944 MEDIUM remediate by: 2026-12-20T03:49:42.036Z

https://github.com/commercelayer/examples/security/dependabot/1183

Related URLs

GHSA-r825-w8mm-5pxw

https://nvd.nist.gov/vuln/detail/CVE-2026-112944

fix: ensure filenames passed to editors are not considered as flags vitejs/launch-editor#156

vitejs/launch-editor@f6e6701

https://github.com/vitejs/launch-editor/releases/tag/v2.14.2

GHSA-r825-w8mm-5pxw

npm-vite >= 8.3.0, <= 8.3.2 examples CVE-2026-112946 MEDIUM remediate by: 2026-12-23T19:49:55.851Z

https://github.com/commercelayer/examples/security/dependabot/1199

Related URLs

GHSA-rq7h-c2jc-7f22

https://nvd.nist.gov/vuln/detail/CVE-2026-112946

fix(server): store ids to safeModulePaths rather than URLs vitejs/vite#23656

vitejs/vite@170b927

vitejs/vite@45c0e33

vitejs/vite@c3e06f9

vitejs/vite@e570d8d

vitejs/vite@f0d76c7

GHSA-rq7h-c2jc-7f22

npm-vite >= 8.3.0, <= 8.3.2 examples CVE-2026-112945 LOW remediate by: 2027-01-22T19:49:56.096Z

https://github.com/commercelayer/examples/security/dependabot/1198

Related URLs

GHSA-9jrq-w75r-8gcw

https://nvd.nist.gov/vuln/detail/CVE-2026-112945

fix(html): filename passed to transformIndexHtml should not include queries vitejs/vite#23653

vitejs/vite@7dafd8e

GHSA-9jrq-w75r-8gcw

npm-follow-redirects >= 1.16.0, < 1.16.1 examples CVE-2026-111755 HIGH remediate by: 2026-11-20T03:49:41.747Z

https://github.com/commercelayer/examples/security/dependabot/1187

Related URLs

GHSA-8r9p-f939-6h3c

https://nvd.nist.gov/vuln/detail/CVE-2026-111755

follow-redirects/follow-redirects@080a76d

https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1

GHSA-8r9p-f939-6h3c

npm-follow-redirects >= 1.16.0, < 1.16.1 examples CVE-2026-111756 HIGH remediate by: 2026-11-20T03:49:41.747Z

https://github.com/commercelayer/examples/security/dependabot/1192

Related URLs

GHSA-q3jh-wrc6-jgq8

follow-redirects/follow-redirects@9865ca4

https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1

GHSA-q3jh-wrc6-jgq8

npm-next >= 16.3.0, < 16.3.8 examples CVE-2026-94544 MEDIUM remediate by: 2026-12-14T19:49:01.651Z

https://github.com/commercelayer/examples/security/dependabot/1159

Related URLs

GHSA-3w37-wq28-93x7

https://nvd.nist.gov/vuln/detail/CVE-2026-94544

vercel/next.js@bd9214f

https://github.com/vercel/next.js/releases/tag/v16.3.8

GHSA-3w37-wq28-93x7

npm-next >= 15.0.0, < 15.5.27 examples CVE-2026-94543 MEDIUM remediate by: 2026-12-15T17:14:20.483Z

https://github.com/commercelayer/examples/security/dependabot/1172

Related URLs

GHSA-4jqv-mc3x-m676

https://nvd.nist.gov/vuln/detail/CVE-2026-94543

vercel/next.js@52c94ab

vercel/next.js@719e4c6

https://github.com/vercel/next.js/releases/tag/v15.5.27

https://github.com/vercel/next.js/releases/tag/v16.3.8

GHSA-4jqv-mc3x-m676

npm-next >= 15.0.0, < 15.5.27 examples CVE-2026-94484 MEDIUM remediate by: 2026-12-15T17:14:20.483Z

https://github.com/commercelayer/examples/security/dependabot/1173

Related URLs

GHSA-mcj8-r9mp-w47p

https://nvd.nist.gov/vuln/detail/CVE-2026-94484

vercel/next.js@52c94ab

vercel/next.js@719e4c6

https://github.com/vercel/next.js/releases/tag/v15.5.27

https://github.com/vercel/next.js/releases/tag/v16.3.8

GHSA-mcj8-r9mp-w47p

npm-hono >= 4.12.4, < 4.13.11 examples CVE-2026-111757 MEDIUM remediate by: 2026-12-20T11:47:06.005Z

https://github.com/commercelayer/examples/security/dependabot/1194

Related URLs

GHSA-5r4p-p66f-jhc7

https://nvd.nist.gov/vuln/detail/CVE-2026-111757

honojs/hono@8b05c77

https://github.com/honojs/hono/releases/tag/v4.13.11

GHSA-5r4p-p66f-jhc7

FIXED npm-postcss-selector-parser < 7.1.6 CVE-2026-104844 MEDIUM

npm-postcss-selector-parser < 7.1.6 examples CVE-2026-104844 MEDIUM remediate by: 2026-12-13T19:47:39.698Z

https://github.com/commercelayer/examples/security/dependabot/1156

Related URLs

GHSA-rj75-hqrm-r3gf

https://nvd.nist.gov/vuln/detail/CVE-2026-104844

postcss/postcss-selector-parser@62b1917

https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6

GHSA-rj75-hqrm-r3gf

Navigation Menu

Repository navigation

[VANTA] [VULNERABILITY] CODE_REPOSITORY <CRITICAL> CVE-2026-102422, CVE-2026-111755, CVE-2026-111756 and others, fix before 2026-11-08 #63

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[VANTA] [VULNERABILITY] CODE_REPOSITORY <CRITICAL> CVE-2026-102422, CVE-2026-111755, CVE-2026-111756 and others, fix before 2026-11-08 #63

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions