What’s Vulnerable › Vulnerabilities

CVE-2026-112943: launch-editor: escapeCmdArgs() omits % escaping on Windows

• Severity: medium (CVSS 6.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-20 · updated 2026-10-20
• Weakness: CWE-78

Description

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.

Affected products

• Npm Launch-Editor: before 2.14.2 — fixed in 2.14.2
• Npm Vite: from 8.3.0 before 8.3.3; from 8.2.0 before 8.2.4; from 8.0.0 before 8.1.6; from 7.0.0 before 7.3.7; before 6.4.4 — fixed in 8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4
• Npm Vite-Plus: before 1.1.0 — fixed in 1.1.0
• vitejs launch-editor: before 2.14.2
• vitejs vite: from 8.3.0, < 8.3.3; from 8.2.0, < 8.2.4; from 8.0.0, < 8.1.6; from 7.0.0, < 7.3.7; before 6.4.4
• vitejs vite-plus: before 1.1.0

How to fix

Upgrade to a fixed version: Npm Launch-Editor 2.14.2; Npm Vite 8.3.3, 8.2.4, 8.1.6, 7.3.7; Npm Vite-Plus 1.1.0. Check the vendor advisory for mitigations.

References

• https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc
• https://github.com/vitejs/launch-editor/pull/155
• https://github.com/vitejs/launch-editor/releases/tag/v2.14.2
• https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv

Get alerted when CVE-2026-112943 or the next vulnerability affects your stack