CVE-2026-112943 · GHSA-698v-4r3x-3vcv
launch-editor: escapeCmdArgs() omits % escaping on Windows
- Risk score
- 50/100
- CVSS
- 6.3 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.…
- Affected
- launch-editor (npm) <= 2.14.1; vite (npm) >= 8.3.0, <= 8.3.2; vite (npm) >= 8.2.0, <= 8.2.3; vite (npm) >= 8.0.0, <= 8.1.5
- Fix
- Upgrade launch-editor to 2.14.2; vite to 8.3.3 or 8.2.4 or 8.1.6 or 7.3.7 or 6.4.4; vite-plus to 1.1.0 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
launch-editor: Amber, patch this week. launch-editor has a vulnerability in its Windows file argument existence check, allowing an attacker to bypass the check and potentially inject OS commands. An attacker could exploit this vulnerability to inject OS commands.
The flaws
- CVE-2026-112943: EscapeCmdArgs() omits % escaping on Windows (CVSS 6.3 · EPSS 0%)
- CVE-2026-112942: `fs.existsSync()` existence check can be bypassed on Windows (CVSS 7.5 · EPSS 1%)
- CVE-2026-112944: Editor CLI flag misinterpretation causing arbitrary command execution for some editors (CVSS 6.3 · EPSS 1%)
The fix
Upgrade launch-editor: 2.14.2 or later on your release line
Who is exposed: {'products': ['launch-editor', 'vite', 'vite-plus'], 'packages': ['launch-editor', 'vite', 'vite-plus'], 'versions': ['launch-editor <= 2.14.1', 'vite >= 8.3.0, <= 8.3.2', 'vite >= 8.2.0, <= 8.2.3', 'vite >= 8.0.0, <= 8.1.5', 'vite >= 7.0.0, <= 7.3.6', 'vite <= 6.4.3', 'vite-plus <= 1.0.0']}
Where it stands
- No known exploitation
Connects to
- Same weakness: OS command injection (CWE-78). 308 other warnings in 30 days
Why it is Yellow
- CVSS 6.3 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| launch-editor | npm | <= 2.14.1 | 2.14.2 |
| vite | npm | >= 8.3.0, <= 8.3.2 | 8.3.3 |
| vite | npm | >= 8.2.0, <= 8.2.3 | 8.2.4 |
| vite | npm | >= 8.0.0, <= 8.1.5 | 8.1.6 |
| vite | npm | >= 7.0.0, <= 7.3.6 | 7.3.7 |
| vite | npm | <= 6.4.3 | 6.4.4 |
| vite-plus | npm | <= 1.0.0 | 1.1.0 |
References
- https://github.com/advisories/GHSA-698v-4r3x-3vcv
- https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv
- https://nvd.nist.gov/vuln/detail/CVE-2026-112943
- https://github.com/vitejs/launch-editor/pull/155
- https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc
- https://github.com/vitejs/launch-editor/releases/tag/v2.14.2
- https://github.com/advisories/GHSA-698v-4r3x-3vcv
Original description
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.
Last activity 20 Oct 2026. Patch Forecast updates every hour.