Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

launch-editor can be tricked into executing commands on Windows

CVE-2026-112942 · published 2 days ago
Summary

The launch-editor package used by Vite tools checks that a file exists before opening it, but on Windows an attacker can disguise a malicious file name so the check is passed even though the file doesn't exist. This can allow the attacker to run commands on the server when the mistake is combined with another Windows path trick. Upgrade launch-editor to version 2.14.2 or later to close the gap.

What to do
  • Update vite-plus to version 1.1.0.
  • Update launch-editor to version 2.14.2.
  • Update vite to version 8.3.3.
  • Update vite to version 8.2.4.
  • Update vite to version 8.1.6.
  • Update vite to version 7.3.7.
  • Update vite to version 6.4.4.
Affected software
Ecosystem VendorProductAffected versions
npm – vite-plus < 1.1.0
<= 1.0.0
Fix: upgrade to 1.1.0
– vitejs launch-editor < 2.14.2
– vitejs vite >= 8.3.0, < 8.3.3
– vitejs vite-plus < 1.1.0
npm – launch-editor <= 2.14.1
< 2.14.2
Fix: upgrade to 2.14.2
npm – vite >= 8.3.0, <= 8.3.2
>= 8.2.0, <= 8.2.3
>= 8.0.0, <= 8.1.5
>= 7.0.0, <= 7.3.6
<= 6.4.3
>= 8.3.0, < 8.3.3
>= 8.2.0, < 8.2.4
>= 8.0.0, < 8.1.6
>= 7.0.0, < 7.3.7
< 6.4.4
Fix: upgrade to 8.3.3
Original advisory text
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-77Command Injection
Timeline
Published20 Oct 2026
Updated22 Oct 2026
First seen20 Oct 2026
Sources
CVE-2026-112942 · NVD
CVE-2026-112942 · MITRE
GHSA-587h-7wmj-h5pm · GHSA
GHSA-587h-7wmj-h5pm · OSV
CVE-2026-112942 · OSV
Track software like this
Free during beta