Skip to content
fr Sign in
6.3 Medium

CVE-2026-112943 launch-editor allows users to open files with line numbers in editor from Node.js

Description

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.

Affected products and versions

Product Affected versions Fixed in
launch-editor 2.14 earliest → < 2.14.2 2.14.2
vite 8.3 8.3.0 → < 8.3.3 8.3.3
vite 8.2 8.2.0 → < 8.2.4 8.2.4
vite 8.0 8.0.0 → < 8.1.6 8.1.6
vite 7.0 7.0.0 → < 7.3.7 7.3.7
vite 6.4 earliest → < 6.4.4 6.4.4
vite-plus 1.1 earliest → < 1.1.0 1.1.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of launch-editor

The 5 CVEs of launch-editor →
CVE-2026-112944 launch-editor allows users to open files with line numbers in editor from Node.js 6.3 Medium CVE-2026-112942 launch-editor allows users to open files with line numbers in editor from Node.js 7.5 High CVE-2026-53632 launch-editor allows users to open files with line numbers in editor from Node.js 5.5 Medium CVE-2024-52011 launch-editor allows users to open files with line numbers in editor from Node.js 7.5 High
Track this CVE