Read the docs
TI-2026-76864 Aliases CVE-2026-112942GHSA-587h-7wmj-h5pm

Existence check bypass in launch-editor can lead to command injection

Priority LOW 38CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

launch-editor before 2.14.2 and vite-plus before 1.1.0 are affected, as are vite from 8.3.0 before 8.3.3, from 8.2.0 before 8.2.4, from 8.0.0 before 8.1.6, from 7.0.0 before 7.3.7, and before 6.4.4. On Windows, a file argument ending in a parent directory and a line and column suffix passes the existence check because launch-editor removes the suffix before existsSync runs. A remote attacker without privileges can combine this with a separate Windows percent-expansion flaw to inject OS commands (CWE-77).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01344 71st percentileScored 2026-11-07
Fix Fixed launch-editor (vitejs): 2.14.2vite (vitejs): 8.3.3, 8.2.4, 8.1.6 +2+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vitejslaunch-editorbefore 2.14.22.14.2Patch availableCNA
vitejsvite8.3.0 to before 8.3.3; 8.2.0 to before 8.2.4; 8.0.0 to before 8.1.6; 7.0.0 to before 7.3.7; before 6.4.48.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4Patch availableCNA
vitejsvite-plusbefore 1.1.01.1.0Patch availableCNA
—launch-editor (npm)before 2.14.22.14.2Patch availableGHSA-587h-7wmj-h5pm
—vite (npm)8.3.0 to before 8.3.38.3.3Patch availableGHSA-587h-7wmj-h5pm
—vite (npm)8.2.0 to before 8.2.48.2.4Patch availableGHSA-587h-7wmj-h5pm
—vite (npm)8.0.0 to before 8.1.68.1.6Patch availableGHSA-587h-7wmj-h5pm
—vite (npm)7.0.0 to before 7.3.77.3.7Patch availableGHSA-587h-7wmj-h5pm
—vite (npm)before 6.4.46.4.4Patch availableGHSA-587h-7wmj-h5pm
—vite-plus (npm)before 1.1.01.1.0Patch availableGHSA-587h-7wmj-h5pm
  • launch-editor Vendorvitejs Affected before 2.14.2 Fixed in 2.14.2 Patch available CNA
  • vite Vendorvitejs Affected 8.3.0 to before 8.3.3; 8.2.0 to before 8.2.4; 8.0.0 to before 8.1.6; 7.0.0 to before 7.3.7; before 6.4.4 Fixed in 8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4 Patch available CNA
  • vite-plus Vendorvitejs Affected before 1.1.0 Fixed in 1.1.0 Patch available CNA
  • launch-editor (npm) Vendor— Affected before 2.14.2 Fixed in 2.14.2 Patch available GHSA-587h-7wmj-h5pm
  • vite (npm) Vendor— Affected 8.3.0 to before 8.3.3 Fixed in 8.3.3 Patch available GHSA-587h-7wmj-h5pm
  • vite (npm) Vendor— Affected 8.2.0 to before 8.2.4 Fixed in 8.2.4 Patch available GHSA-587h-7wmj-h5pm
  • vite (npm) Vendor— Affected 8.0.0 to before 8.1.6 Fixed in 8.1.6 Patch available GHSA-587h-7wmj-h5pm
  • vite (npm) Vendor— Affected 7.0.0 to before 7.3.7 Fixed in 7.3.7 Patch available GHSA-587h-7wmj-h5pm
  • vite (npm) Vendor— Affected before 6.4.4 Fixed in 6.4.4 Patch available GHSA-587h-7wmj-h5pm
  • vite-plus (npm) Vendor— Affected before 1.1.0 Fixed in 1.1.0 Patch available GHSA-587h-7wmj-h5pm

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:vitejs:vite:*:*:*:*:*:*:*:*——vitejs
  • cpe:2.3:a:vitejs:vite:*:*:*:*:*:*:*:* Versions — — ·vitejs

Remediation

Update launch-editor to 2.14.2. Update vite to 8.3.3, 8.2.4, 8.1.6, 7.3.7 or 6.4.4, matching the release line in use. Update vite-plus to 1.1.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA launch-editor (vitejs) Fixed in 2.14.2
  • Fix · CNA vite (vitejs) Fixed in 8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4
  • Fix · CNA vite-plus (vitejs) Fixed in 1.1.0
  • Fix · GHSA-587h-7wmj-h5pm launch-editor (npm) Fixed in 2.14.2 Advisory →
  • Fix · GHSA-587h-7wmj-h5pm vite (npm) Fixed in 8.3.3 Advisory →
  • Fix · GHSA-587h-7wmj-h5pm vite (npm) Fixed in 8.2.4 Advisory →
  • Fix · GHSA-587h-7wmj-h5pm vite (npm) Fixed in 8.1.6 Advisory →
  • Fix · GHSA-587h-7wmj-h5pm vite (npm) Fixed in 7.3.7 Advisory →
  • Fix · GHSA-587h-7wmj-h5pm vite (npm) Fixed in 6.4.4 Advisory →
  • Fix · GHSA-587h-7wmj-h5pm vite-plus (npm) Fixed in 1.1.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-112942
  2. 2026-10-21 Alias added: GHSA-587h-7wmj-h5pm
  3. 2026-10-21 Fix available: npm/[email protected], npm/[email protected], npm/[email protected] +4 · GHSA-587h-7wmj-h5pm
  4. 2026-10-21 CVSS score added · GHSA-587h-7wmj-h5pm
  5. 2026-10-21 Weakness changed · GHSA-587h-7wmj-h5pm
  6. 2026-10-21 5 new references · GHSA-587h-7wmj-h5pm
  7. 2026-10-21 Affected versions changed · Red Hat
  8. 2026-10-21 CVSS score added · Red Hat
  9. 2026-10-21 CISA SSVC decision points changed
  10. 2026-10-21 Priority changed: MEDIUM → LOW

References

Advisory 1

Other 4

  • TI-2025-22386 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query KEVCVSS 3.1HIGH 7.5
  • TI-2025-41248 Code injection in vitejs vite-plugin-react CVSS 3.1CRITICAL 9.8
  • TI-2026-28350 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket CVSS 4.0HIGH 8.2
  • TI-2025-41735 @vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development CVSS 3.1HIGH 7.5
  • TI-2025-21544 Vite bypasses server.fs.deny when using `?raw??` CVSS 3.1HIGH 7.5
  • TI-2023-16938 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) CVSS 3.1HIGH 7.5
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences