CVE-2026-112944 · GHSA-r825-w8mm-5pxw
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
- Risk score
- 53/100
- CVSS
- 6.3 v4.0
- Exploit chance (30 days)
- 0.7%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor…
- Affected
- launch-editor (npm) <= 2.14.1; vite (npm) >= 8.3.0, <= 8.3.2; vite (npm) >= 8.2.0, <= 8.2.3; vite (npm) >= 8.0.0, <= 8.1.5
- Fix
- Upgrade launch-editor to 2.14.2; vite to 8.3.3 or 8.2.4 or 8.1.6 or 7.3.7 or 6.4.4; vite-plus to 1.1.0 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
launch-editor: Amber, patch this week. launch-editor has a vulnerability in its Windows file argument existence check, allowing an attacker to bypass the check and potentially inject OS commands. An attacker could exploit this vulnerability to inject OS commands.
The flaws
- CVE-2026-112944: Editor CLI flag misinterpretation causing arbitrary command execution for some editors (CVSS 6.3 · EPSS 1%)
- CVE-2026-112942: `fs.existsSync()` existence check can be bypassed on Windows (CVSS 7.5 · EPSS 1%)
- CVE-2026-112943: EscapeCmdArgs() omits % escaping on Windows (CVSS 6.3 · EPSS 0%)
The fix
Upgrade launch-editor: 2.14.2 or later on your release line
Who is exposed: {'products': ['launch-editor', 'vite', 'vite-plus'], 'packages': ['launch-editor', 'vite', 'vite-plus'], 'versions': ['launch-editor <= 2.14.1', 'vite >= 8.3.0, <= 8.3.2', 'vite >= 8.2.0, <= 8.2.3', 'vite >= 8.0.0, <= 8.1.5', 'vite >= 7.0.0, <= 7.3.6', 'vite <= 6.4.3', 'vite-plus <= 1.0.0']}
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-88 (CWE-88). 43 other warnings in 30 days
Why it is Yellow
- CVSS 6.3 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| launch-editor | npm | <= 2.14.1 | 2.14.2 |
| vite | npm | >= 8.3.0, <= 8.3.2 | 8.3.3 |
| vite | npm | >= 8.2.0, <= 8.2.3 | 8.2.4 |
| vite | npm | >= 8.0.0, <= 8.1.5 | 8.1.6 |
| vite | npm | >= 7.0.0, <= 7.3.6 | 7.3.7 |
| vite | npm | <= 6.4.3 | 6.4.4 |
| vite-plus | npm | <= 1.0.0 | 1.1.0 |
References
- https://github.com/advisories/GHSA-r825-w8mm-5pxw
- https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw
- https://nvd.nist.gov/vuln/detail/CVE-2026-112944
- https://github.com/vitejs/launch-editor/pull/156
- https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4
- https://github.com/vitejs/launch-editor/releases/tag/v2.14.2
- https://github.com/advisories/GHSA-r825-w8mm-5pxw
Original description
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.
Last activity 20 Oct 2026. Patch Forecast updates every hour.