Log in Start free

Vulnerability · Published Oct 20, 2026 · Assigned by GitHub_M

CVE-2026-112943launch-editor: escapeCmdArgs() omits % escaping on Windows

Medium 6.3

In plain English

A medium-severity OS command injection in launch-editor from vitejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.4%top 64.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmlaunch-editor2.14.2GHSA-698v-4r3x-3vcv
npmvite8.3.3GHSA-698v-4r3x-3vcv
npmvite8.2.4GHSA-698v-4r3x-3vcv
npmvite8.1.6GHSA-698v-4r3x-3vcv
npmvite7.3.7GHSA-698v-4r3x-3vcv
npmvite6.4.4GHSA-698v-4r3x-3vcv
npmvite-plus1.1.0GHSA-698v-4r3x-3vcv

Affected products (as reported)

VendorProductVersions
vitejs launch-editor < 2.14.2
vitejs vite >= 8.3.0, < 8.3.3>= 8.2.0, < 8.2.4>= 8.0.0, < 8.1.6>= 7.0.0, < 7.3.7< 6.4.4
vitejs vite-plus < 1.1.0

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References