CVE-2026-112942 · GHSA-587h-7wmj-h5pm
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
- Risk score
- 69/100
- CVSS
- 7.5 v4.0
- Exploit chance (30 days)
- 1.3%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- launch-editor has a vulnerability in its Windows file argument existence check, allowing an attacker to bypass the check and potentially inject OS commands. An attacker could exploit this vulnerability to inject OS commands.
- Affected
- {'products': ['launch-editor', 'vite', 'vite-plus'], 'packages': ['launch-editor', 'vite', 'vite-plus'], 'versions': ['launch-editor <= 2.14.1', 'vite >= 8.3.0, <= 8.3.2', 'vite >= 8.2.0, <= 8.2.3', 'vite >= 8.0.0, <= 8.1.5', 'vite >= 7.0.0, <= 7.3.6', 'vite <= 6.4.3', 'vite-plus <= 1.0.0']}
- Fix
- Upgrade to version 2.14.2 for launch-editor, or version 8.3.3 for vite, or version 8.2.4 for vite, or version 8.1.6 for vite, or version 7.3.7 for vite, or version 6.4.4 for vite, or version 1.1.0 for vite-plus.
- Exploitation
- No known exploitation
Story map
At a glance
launch-editor: Amber, patch this week. launch-editor has a vulnerability in its Windows file argument existence check, allowing an attacker to bypass the check and potentially inject OS commands. An attacker could exploit this vulnerability to inject OS commands.
The flaws
- CVE-2026-112942: `fs.existsSync()` existence check can be bypassed on Windows (CVSS 7.5 · EPSS 1%)
- CVE-2026-112944: Editor CLI flag misinterpretation causing arbitrary command execution for some editors (CVSS 6.3 · EPSS 1%)
- CVE-2026-112943: EscapeCmdArgs() omits % escaping on Windows (CVSS 6.3 · EPSS 0%)
The fix
Upgrade launch-editor: 2.14.2 or later on your release line
Who is exposed: {'products': ['launch-editor', 'vite', 'vite-plus'], 'packages': ['launch-editor', 'vite', 'vite-plus'], 'versions': ['launch-editor <= 2.14.1', 'vite >= 8.3.0, <= 8.3.2', 'vite >= 8.2.0, <= 8.2.3', 'vite >= 8.0.0, <= 8.1.5', 'vite >= 7.0.0, <= 7.3.6', 'vite <= 6.4.3', 'vite-plus <= 1.0.0']}
Where it stands
- No known exploitation
Connects to
- Same weakness: Command injection (CWE-77). 97 other warnings in 30 days
Why it is Amber
- CVSS 7.5 high
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| launch-editor | npm | <= 2.14.1 | 2.14.2 |
| vite | npm | >= 8.3.0, <= 8.3.2 | 8.3.3 |
| vite | npm | >= 8.2.0, <= 8.2.3 | 8.2.4 |
| vite | npm | >= 8.0.0, <= 8.1.5 | 8.1.6 |
| vite | npm | >= 7.0.0, <= 7.3.6 | 7.3.7 |
| vite | npm | <= 6.4.3 | 6.4.4 |
| vite-plus | npm | <= 1.0.0 | 1.1.0 |
References
- https://github.com/advisories/GHSA-587h-7wmj-h5pm
- https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm
- https://nvd.nist.gov/vuln/detail/CVE-2026-112942
- https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679
- https://github.com/vitejs/launch-editor/releases/tag/v2.14.2
- https://github.com/advisories/GHSA-587h-7wmj-h5pm
Original description
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.
Last activity 20 Oct 2026. Patch Forecast updates every hour.