Vulnerability · Published Oct 20, 2026 · Assigned by GitHub_M

CVE-2026-112944launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

Medium 6.3

In plain English

A medium-severity argument injection in launch-editor from vitejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.7%top 46.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	launch-editor	2.14.2	GHSA-r825-w8mm-5pxw
npm	vite	8.3.3	GHSA-r825-w8mm-5pxw
npm	vite	8.2.4	GHSA-r825-w8mm-5pxw
npm	vite	8.1.6	GHSA-r825-w8mm-5pxw
npm	vite	7.3.7	GHSA-r825-w8mm-5pxw
npm	vite	6.4.4	GHSA-r825-w8mm-5pxw
npm	vite-plus	1.1.0	GHSA-r825-w8mm-5pxw

Affected products (as reported)

Vendor	Product	Versions
vitejs	launch-editor	< 2.14.2
vitejs	vite	>= 8.3.0, < 8.3.3>= 8.2.0, < 8.2.4>= 8.0.0, < 8.1.6>= 7.0.0, < 7.3.7< 6.4.4
vitejs	vite-plus	< 1.1.0

Weakness: CWE-88 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw x_refsource_CONFIRM
https://github.com/vitejs/launch-editor/pull/156 x_refsource_MISC
https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4 x_refsource_MISC
https://github.com/vitejs/launch-editor/releases/tag/v2.14.2 x_refsource_MISC