{"id":"CVE-2026-112944","title":"launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors","summary":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-88"],"vendor":"vitejs","product":"launch-editor","affected":["launch-editor < 2.14.2","vite >= 8.3.0, < 8.3.3","vite >= 8.2.0, < 8.2.4","vite >= 8.0.0, < 8.1.6","vite >= 7.0.0, < 7.3.7","vite < 6.4.4","vite-plus < 1.1.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-20T15:22:50.878612Z"},"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T15:23:12.248Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112944","references":[{"url":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw","label":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw"},{"url":"https://github.com/vitejs/launch-editor/pull/156","label":"https://github.com/vitejs/launch-editor/pull/156"},{"url":"https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4","label":"https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4"},{"url":"https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","label":"https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T15:09:24.111Z","slug":"CVE-2026-112944","body":"## Overview\n\nlaunch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.\n\n## Affected\n\n- `launch-editor < 2.14.2`\n- `vite >= 8.3.0, < 8.3.3`\n- `vite >= 8.2.0, < 8.2.4`\n- `vite >= 8.0.0, < 8.1.6`\n- `vite >= 7.0.0, < 7.3.7`\n- `vite < 6.4.4`\n- `vite-plus < 1.1.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}