{"id":"CVE-2026-112943","title":"launch-editor: escapeCmdArgs() omits % escaping on Windows","summary":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it w…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-78"],"vendor":"vitejs","product":"launch-editor","affected":["launch-editor < 2.14.2","vite >= 8.3.0, < 8.3.3","vite >= 8.2.0, < 8.2.4","vite >= 8.0.0, < 8.1.6","vite >= 7.0.0, < 7.3.7","vite < 6.4.4","vite-plus < 1.1.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-20T15:13:29.374778Z"},"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T15:13:40.862Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112943","references":[{"url":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv","label":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv"},{"url":"https://github.com/vitejs/launch-editor/pull/155","label":"https://github.com/vitejs/launch-editor/pull/155"},{"url":"https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","label":"https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc"},{"url":"https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","label":"https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T15:09:24.114Z","slug":"CVE-2026-112943","body":"## Overview\n\nlaunch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.\n\n## Affected\n\n- `launch-editor < 2.14.2`\n- `vite >= 8.3.0, < 8.3.3`\n- `vite >= 8.2.0, < 8.2.4`\n- `vite >= 8.0.0, < 8.1.6`\n- `vite >= 7.0.0, < 7.3.7`\n- `vite < 6.4.4`\n- `vite-plus < 1.1.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}