Read the docs
TI-2026-76865 Aliases CVE-2026-112943GHSA-698v-4r3x-3vcv

Improper % escaping in launch-editor escapeCmdArgs() on Windows

Priority LOW 28CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

launch-editor, a Node.js package that opens files in an editor at a given line, does not escape % characters in arguments passed to cmd on Windows before version 2.14.2. When an environment variable contains a malicious value, an attacker can get that content executed through cmd, which matches CWE-78 (OS command injection). The attack needs no privileges and no user interaction over the network. The CVSS 4.0 base score is 6.3 (Medium), with low confidentiality, integrity and availability impact.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00414 35th percentileScored 2026-11-07
Fix Fixed launch-editor (vitejs): 2.14.2vite (vitejs): 8.3.3, 8.2.4, 8.1.6 +2+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vitejslaunch-editorbefore 2.14.22.14.2Patch availableCNA
vitejsvite8.3.0 to before 8.3.3; 8.2.0 to before 8.2.4; 8.0.0 to before 8.1.6; 7.0.0 to before 7.3.7; before 6.4.48.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4Patch availableCNA
vitejsvite-plusbefore 1.1.01.1.0Patch availableCNA
—launch-editor (npm)before 2.14.22.14.2Patch availableGHSA-698v-4r3x-3vcv
—vite (npm)8.3.0 to before 8.3.38.3.3Patch availableGHSA-698v-4r3x-3vcv
—vite (npm)8.2.0 to before 8.2.48.2.4Patch availableGHSA-698v-4r3x-3vcv
—vite (npm)8.0.0 to before 8.1.68.1.6Patch availableGHSA-698v-4r3x-3vcv
—vite (npm)7.0.0 to before 7.3.77.3.7Patch availableGHSA-698v-4r3x-3vcv
—vite (npm)before 6.4.46.4.4Patch availableGHSA-698v-4r3x-3vcv
—vite-plus (npm)before 1.1.01.1.0Patch availableGHSA-698v-4r3x-3vcv
  • launch-editor Vendorvitejs Affected before 2.14.2 Fixed in 2.14.2 Patch available CNA
  • vite Vendorvitejs Affected 8.3.0 to before 8.3.3; 8.2.0 to before 8.2.4; 8.0.0 to before 8.1.6; 7.0.0 to before 7.3.7; before 6.4.4 Fixed in 8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4 Patch available CNA
  • vite-plus Vendorvitejs Affected before 1.1.0 Fixed in 1.1.0 Patch available CNA
  • launch-editor (npm) Vendor— Affected before 2.14.2 Fixed in 2.14.2 Patch available GHSA-698v-4r3x-3vcv
  • vite (npm) Vendor— Affected 8.3.0 to before 8.3.3 Fixed in 8.3.3 Patch available GHSA-698v-4r3x-3vcv
  • vite (npm) Vendor— Affected 8.2.0 to before 8.2.4 Fixed in 8.2.4 Patch available GHSA-698v-4r3x-3vcv
  • vite (npm) Vendor— Affected 8.0.0 to before 8.1.6 Fixed in 8.1.6 Patch available GHSA-698v-4r3x-3vcv
  • vite (npm) Vendor— Affected 7.0.0 to before 7.3.7 Fixed in 7.3.7 Patch available GHSA-698v-4r3x-3vcv
  • vite (npm) Vendor— Affected before 6.4.4 Fixed in 6.4.4 Patch available GHSA-698v-4r3x-3vcv
  • vite-plus (npm) Vendor— Affected before 1.1.0 Fixed in 1.1.0 Patch available GHSA-698v-4r3x-3vcv

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:vitejs:vite:*:*:*:*:*:*:*:*——vitejs
  • cpe:2.3:a:vitejs:vite:*:*:*:*:*:*:*:* Versions — — ·vitejs

Remediation

Update launch-editor to version 2.14.2 or later. For vite, use 8.3.3, 8.2.4, 8.1.6, 7.3.7 or 6.4.4, matching the release line in use. For vite-plus, use 1.1.0. The sources list no fixed version for these packages, but the npm records give the versions above.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA launch-editor (vitejs) Fixed in 2.14.2
  • Fix · CNA vite (vitejs) Fixed in 8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4
  • Fix · CNA vite-plus (vitejs) Fixed in 1.1.0
  • Fix · GHSA-698v-4r3x-3vcv launch-editor (npm) Fixed in 2.14.2 Advisory →
  • Fix · GHSA-698v-4r3x-3vcv vite (npm) Fixed in 8.3.3 Advisory →
  • Fix · GHSA-698v-4r3x-3vcv vite (npm) Fixed in 8.2.4 Advisory →
  • Fix · GHSA-698v-4r3x-3vcv vite (npm) Fixed in 8.1.6 Advisory →
  • Fix · GHSA-698v-4r3x-3vcv vite (npm) Fixed in 7.3.7 Advisory →
  • Fix · GHSA-698v-4r3x-3vcv vite (npm) Fixed in 6.4.4 Advisory →
  • Fix · GHSA-698v-4r3x-3vcv vite-plus (npm) Fixed in 1.1.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-112943
  2. 2026-10-21 Alias added: GHSA-698v-4r3x-3vcv
  3. 2026-10-21 Fix available: npm/[email protected], npm/[email protected], npm/[email protected] +4 · GHSA-698v-4r3x-3vcv
  4. 2026-10-21 CVSS score added · GHSA-698v-4r3x-3vcv
  5. 2026-10-21 Weakness changed · GHSA-698v-4r3x-3vcv
  6. 2026-10-21 6 new references · GHSA-698v-4r3x-3vcv
  7. 2026-10-21 Affected versions changed · Red Hat
  8. 2026-10-21 CVSS score added · Red Hat

References

Advisory 1

Other 5

  • TI-2025-22386 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query KEVCVSS 3.1HIGH 7.5
  • TI-2025-41248 Code injection in vitejs vite-plugin-react CVSS 3.1CRITICAL 9.8
  • TI-2026-28350 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket CVSS 4.0HIGH 8.2
  • TI-2025-41735 @vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development CVSS 3.1HIGH 7.5
  • TI-2025-21544 Vite bypasses server.fs.deny when using `?raw??` CVSS 3.1HIGH 7.5
  • TI-2023-16938 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) CVSS 3.1HIGH 7.5
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences