html-demo

This Vite preview middleware places the request-controlled `entry` query parameter into an HTML script attribute without escaping or path validation, creating an injection risk and potentially allowing selection of unintended files subject to Vite access controls. The configured `theme` value is also inserted without escaping, though it is normally trusted configuration. Severity is context-dependent and elevated if the development server is reachable by untrusted users; no direct data theft or other malware behavior is shown.