CVE-2026-112943Medium· 6.3▾ Sunlitlaunch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it w…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.
launch-editor < 2.14.2vite >= 8.3.0, < 8.3.3vite >= 8.2.0, < 8.2.4vite >= 8.0.0, < 8.1.6vite >= 7.0.0, < 7.3.7vite < 6.4.4vite-plus < 1.1.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112942High· 7.5launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
CVE-2026-112944Medium· 6.3launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
CVE-2026-53632Mediumlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
CVE-2026-112945Low· 2.1Vite: Cross origin script execution through Vite custom middleware
CVE-2026-112946Medium· 6.3Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
CVE-2026-112947Medium· 6.3Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`