Read the docs
TI-2026-76866 Aliases CVE-2026-112944GHSA-r825-w8mm-5pxw

Argument injection in launch-editor allows editor command execution

Priority LOW 29CWE-88Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-88.

Summary

The launch-editor npm package before 2.14.2 is affected, and so are Vite and vite-plus builds that depend on it. Improper neutralization of argument delimiters (CWE-88) lets launchEditor pass a file name starting with a plus or minus sign to the editor as a command-line flag. An attacker who can create files in the working directory can overwrite files or run commands through the selected editor, such as Vim, Emacs or Notepad++.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00705 53rd percentileScored 2026-11-07
Fix Fixed launch-editor (vitejs): 2.14.2vite (vitejs): 8.3.3, 8.2.4, 8.1.6 +2+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vitejslaunch-editorbefore 2.14.22.14.2Patch availableCNA
vitejsvite8.3.0 to before 8.3.3; 8.2.0 to before 8.2.4; 8.0.0 to before 8.1.6; 7.0.0 to before 7.3.7; before 6.4.48.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4Patch availableCNA
vitejsvite-plusbefore 1.1.01.1.0Patch availableCNA
—launch-editor (npm)before 2.14.22.14.2Patch availableGHSA-r825-w8mm-5pxw
—vite (npm)8.3.0 to before 8.3.38.3.3Patch availableGHSA-r825-w8mm-5pxw
—vite (npm)8.2.0 to before 8.2.48.2.4Patch availableGHSA-r825-w8mm-5pxw
—vite (npm)8.0.0 to before 8.1.68.1.6Patch availableGHSA-r825-w8mm-5pxw
—vite (npm)7.0.0 to before 7.3.77.3.7Patch availableGHSA-r825-w8mm-5pxw
—vite (npm)before 6.4.46.4.4Patch availableGHSA-r825-w8mm-5pxw
—vite-plus (npm)before 1.1.01.1.0Patch availableGHSA-r825-w8mm-5pxw
  • launch-editor Vendorvitejs Affected before 2.14.2 Fixed in 2.14.2 Patch available CNA
  • vite Vendorvitejs Affected 8.3.0 to before 8.3.3; 8.2.0 to before 8.2.4; 8.0.0 to before 8.1.6; 7.0.0 to before 7.3.7; before 6.4.4 Fixed in 8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4 Patch available CNA
  • vite-plus Vendorvitejs Affected before 1.1.0 Fixed in 1.1.0 Patch available CNA
  • launch-editor (npm) Vendor— Affected before 2.14.2 Fixed in 2.14.2 Patch available GHSA-r825-w8mm-5pxw
  • vite (npm) Vendor— Affected 8.3.0 to before 8.3.3 Fixed in 8.3.3 Patch available GHSA-r825-w8mm-5pxw
  • vite (npm) Vendor— Affected 8.2.0 to before 8.2.4 Fixed in 8.2.4 Patch available GHSA-r825-w8mm-5pxw
  • vite (npm) Vendor— Affected 8.0.0 to before 8.1.6 Fixed in 8.1.6 Patch available GHSA-r825-w8mm-5pxw
  • vite (npm) Vendor— Affected 7.0.0 to before 7.3.7 Fixed in 7.3.7 Patch available GHSA-r825-w8mm-5pxw
  • vite (npm) Vendor— Affected before 6.4.4 Fixed in 6.4.4 Patch available GHSA-r825-w8mm-5pxw
  • vite-plus (npm) Vendor— Affected before 1.1.0 Fixed in 1.1.0 Patch available GHSA-r825-w8mm-5pxw

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:vitejs:vite:*:*:*:*:*:*:*:*——vitejs
  • cpe:2.3:a:vitejs:vite:*:*:*:*:*:*:*:* Versions — — ·vitejs

Remediation

The fixed versions are launch-editor 2.14.2, vite 8.3.3, 8.2.4, 8.1.6, 7.3.7 and 6.4.4, and vite-plus 1.1.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA launch-editor (vitejs) Fixed in 2.14.2
  • Fix · CNA vite (vitejs) Fixed in 8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4
  • Fix · CNA vite-plus (vitejs) Fixed in 1.1.0
  • Fix · GHSA-r825-w8mm-5pxw launch-editor (npm) Fixed in 2.14.2 Advisory →
  • Fix · GHSA-r825-w8mm-5pxw vite (npm) Fixed in 8.3.3 Advisory →
  • Fix · GHSA-r825-w8mm-5pxw vite (npm) Fixed in 8.2.4 Advisory →
  • Fix · GHSA-r825-w8mm-5pxw vite (npm) Fixed in 8.1.6 Advisory →
  • Fix · GHSA-r825-w8mm-5pxw vite (npm) Fixed in 7.3.7 Advisory →
  • Fix · GHSA-r825-w8mm-5pxw vite (npm) Fixed in 6.4.4 Advisory →
  • Fix · GHSA-r825-w8mm-5pxw vite-plus (npm) Fixed in 1.1.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-112944
  2. 2026-10-21 Alias added: GHSA-r825-w8mm-5pxw
  3. 2026-10-21 Fix available: npm/[email protected], npm/[email protected], npm/[email protected] +4 · GHSA-r825-w8mm-5pxw
  4. 2026-10-21 CVSS score added · GHSA-r825-w8mm-5pxw
  5. 2026-10-21 Weakness changed · GHSA-r825-w8mm-5pxw
  6. 2026-10-21 6 new references · GHSA-r825-w8mm-5pxw
  7. 2026-10-21 Affected versions changed · Red Hat
  8. 2026-10-21 CVSS score added · Red Hat

References

Advisory 1

Other 5

  • TI-2025-22386 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query KEVCVSS 3.1HIGH 7.5
  • TI-2025-41248 Code injection in vitejs vite-plugin-react CVSS 3.1CRITICAL 9.8
  • TI-2026-28350 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket CVSS 4.0HIGH 8.2
  • TI-2025-41735 @vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development CVSS 3.1HIGH 7.5
  • TI-2025-21544 Vite bypasses server.fs.deny when using `?raw??` CVSS 3.1HIGH 7.5
  • TI-2023-16938 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) CVSS 3.1HIGH 7.5
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences