CVE-2026-112942
HighCVSS 7.5Summary
launch-editor-middleware prior to 2.14.2 mishandles an attacker-controlled Windows file argument ending in a parent-directory component plus a line-and-column suffix. The path is resolved with the suffix present, and the suffix is removed before the existsSync check, bypassing filename existence validation. Combined with a separate Windows percent-expansion flaw, this can lead to OS command injection.
Risk Assessment
Bypassing filename validation may enable OS command injection in a development environment, leading to code execution on the developer workstation.
Recommendation
Upgrade launch-editor to version 2.14.2 or later. Avoid running development servers with untrusted input.
Other vulnerabilities in launch-editor
See all- CVE-2026-112944Medium
launch-editor before 2.14.2 does not force a file path to be interpreted as a positional filename. If an attacker creates a file starting with a plus or minus in the working directory, the selected editor (Vim, gVim, MacVim, Emacs, Emacsclient, Notepad++ with a plugin) treats the attacker-controlled filename as a command-line flag, potentially causing unintended file overwrite or arbitrary command execution.
- CVE-2026-112943Medium
launch-editor before 2.14.2 did not escape % on Windows when passing an argument to cmd. If an environment variable contained a malicious value, that content could be executed.
- CVE-2024-52011High
A vulnerability in the launch-editor library (used by Vite) before version 2.9.0 allows arbitrary command execution on Windows. The issue stems from insufficient sanitization of the `file` argument in the `launchEditor` function, enabling an attacker to inject special characters.
Original NVD description (English source)
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS