CVE-2026-112943
MediumCVSS 6.3Summary
launch-editor before 2.14.2 did not escape % on Windows when passing an argument to cmd. If an environment variable contained a malicious value, that content could be executed.
Risk Assessment
Potential arbitrary command execution on Windows if an attacker controls an environment variable value used by launch-editor.
Recommendation
Update launch-editor to version 2.14.2 or later.
Other vulnerabilities in launch-editor
See all- CVE-2026-112944Medium
launch-editor before 2.14.2 does not force a file path to be interpreted as a positional filename. If an attacker creates a file starting with a plus or minus in the working directory, the selected editor (Vim, gVim, MacVim, Emacs, Emacsclient, Notepad++ with a plugin) treats the attacker-controlled filename as a command-line flag, potentially causing unintended file overwrite or arbitrary command execution.
- CVE-2026-112942High
launch-editor-middleware prior to 2.14.2 mishandles an attacker-controlled Windows file argument ending in a parent-directory component plus a line-and-column suffix. The path is resolved with the suffix present, and the suffix is removed before the existsSync check, bypassing filename existence validation. Combined with a separate Windows percent-expansion flaw, this can lead to OS command injection.
- CVE-2024-52011High
A vulnerability in the launch-editor library (used by Vite) before version 2.9.0 allows arbitrary command execution on Windows. The issue stems from insufficient sanitization of the `file` argument in the `launchEditor` function, enabling an attacker to inject special characters.
Original NVD description (English source)
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS