CVE-2026-112944: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

Severity: medium (CVSS 6.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-20 · updated 2026-10-20
Weakness: CWE-88

Description

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.

Affected products

Npm Launch-Editor: before 2.14.2 — fixed in 2.14.2
Npm Vite: from 8.3.0 before 8.3.3; from 8.2.0 before 8.2.4; from 8.0.0 before 8.1.6; from 7.0.0 before 7.3.7; before 6.4.4 — fixed in 8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4
Npm Vite-Plus: before 1.1.0 — fixed in 1.1.0
vitejs launch-editor: before 2.14.2
vitejs vite: from 8.3.0, < 8.3.3; from 8.2.0, < 8.2.4; from 8.0.0, < 8.1.6; from 7.0.0, < 7.3.7; before 6.4.4
vitejs vite-plus: before 1.1.0

How to fix

Upgrade to a fixed version: Npm Launch-Editor 2.14.2; Npm Vite 8.3.3, 8.2.4, 8.1.6, 7.3.7; Npm Vite-Plus 1.1.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-112944 or the next vulnerability affects your stack