CVE-2026-112944Medium· 6.3▾ Sunlitlaunch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.
launch-editor < 2.14.2vite >= 8.3.0, < 8.3.3vite >= 8.2.0, < 8.2.4vite >= 8.0.0, < 8.1.6vite >= 7.0.0, < 7.3.7vite < 6.4.4vite-plus < 1.1.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112942High· 7.5launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
CVE-2026-112943Medium· 6.3launch-editor: escapeCmdArgs() omits % escaping on Windows
CVE-2026-53632Mediumlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
CVE-2026-112945Low· 2.1Vite: Cross origin script execution through Vite custom middleware
CVE-2026-112946Medium· 6.3Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
CVE-2026-112947Medium· 6.3Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`