launch-editor vulnerabilities

launch-editor before 2.14.2 does not force a file path to be interpreted as a positional filename. If an attacker creates a file starting with a plus or minus in the working directory, the selected editor (Vim, gVim, MacVim, Emacs, Emacsclient, Notepad++ with a plugin) treats the attacker-controlled filename as a command-line flag, potentially causing unintended file overwrite or arbitrary command execution.

launch-editor before 2.14.2 did not escape % on Windows when passing an argument to cmd. If an environment variable contained a malicious value, that content could be executed.

launch-editor-middleware prior to 2.14.2 mishandles an attacker-controlled Windows file argument ending in a parent-directory component plus a line-and-column suffix. The path is resolved with the suffix present, and the suffix is removed before the existsSync check, bypassing filename existence validation. Combined with a separate Windows percent-expansion flaw, this can lead to OS command injection.

A vulnerability in the launch-editor library (used by Vite) before version 2.9.0 allows arbitrary command execution on Windows. The issue stems from insufficient sanitization of the `file` argument in the `launchEditor` function, enabling an attacker to inject special characters.