{"id":"EUVD-2026-105039","enisaUuid":"43dfa776-ea03-3de2-8a0d-05b0f86b4929","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.","datePublished":"Oct 20, 2026, 2:53:41 PM","dateUpdated":"Oct 20, 2026, 3:13:40 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv\nhttps://github.com/vitejs/launch-editor/pull/155\nhttps://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc\nhttps://github.com/vitejs/launch-editor/releases/tag/v2.14.2\n","aliases":"CVE-2026-112943\nGHSA-698v-4r3x-3vcv\n","assigner":"GitHub_M","epss":0.41,"enisaIdProduct":[{"id":"6cce0547-1e39-3eaf-82f1-5559fa31164c","product":{"name":"launch-editor","vendor":{"name":"vitejs"}},"product_version":"\u003c 2.14.2"},{"id":"7a1260d5-03c5-3bf2-9db7-70bc9232f270","product":{"name":"vite-plus","vendor":{"name":"voidzero-dev"}},"product_version":"\u003c 1.1.0"},{"id":"8d28e73e-3e1e-3935-9b4e-b3f0b3d2001c","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"7.0.0, \u003c 7.3.7"},{"id":"99d98b4e-08b4-39ff-bfa2-76fb005cb056","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"8.3.0, \u003c 8.3.3"},{"id":"9b5b8936-4c36-377c-8f19-6be9fbe5d84a","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"8.2.0, \u003c 8.2.4"},{"id":"d7a4bd25-7e8e-3ed0-95eb-b50b8adb7c88","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"\u003c 6.4.4"},{"id":"f9f0c849-ff7c-350f-bb24-0f71deb11a21","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"8.0.0, \u003c 8.1.6"}],"enisaIdVendor":[{"id":"17bce58a-9da2-3011-9ca4-78e4483e653c","vendor":{"name":"vitejs"}}],"enisaIdVulnerability":[{"id":"bfec6c76-4146-374d-8bfc-c3b0fbfb3c1d","vulnerability":{"id":"CVE-2026-112943","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.","datePublished":"Oct 20, 2026, 2:53:41 PM","dateUpdated":"Oct 20, 2026, 3:13:40 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv\nhttps://github.com/vitejs/launch-editor/pull/155\nhttps://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc\nhttps://github.com/vitejs/launch-editor/releases/tag/v2.14.2\n","enisa_id":"EUVD-2026-105039\n","assigner":"GitHub_M","epss":0.41,"dataProcessed":"Nov 2, 2026, 7:15:14 AM","vulnerabilityProduct":[{"id":"0dcdc1a1-d1e8-3d6a-9f89-41ef2f2eedc3","product":{"name":"vite-plus","vendor":{"name":"voidzero-dev"}},"product_version":"\u003c 1.1.0"},{"id":"3bcc68c3-de1c-3845-8854-db841c6bf859","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"8.0.0, \u003c 8.1.6"},{"id":"8f90a355-5e91-394a-a980-027c226078d8","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"8.3.0, \u003c 8.3.3"},{"id":"a0662307-983c-3f56-a4d7-1241b7b3cb52","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"7.0.0, \u003c 7.3.7"},{"id":"d975bbd2-9c7b-30be-b0a2-ac0b77ef56d7","product":{"name":"launch-editor","vendor":{"name":"vitejs"}},"product_version":"\u003c 2.14.2"},{"id":"f5c7ffa5-00a6-31fc-8145-e001f81a2da0","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"8.2.0, \u003c 8.2.4"},{"id":"fd2bcf17-3665-38c0-b3e1-64260ec48c4b","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"\u003c 6.4.4"}],"vulnerabilityVendor":[{"id":"11ea12a6-e464-357f-b16c-9b7d112044ba","vendor":{"name":"vitejs"}}]}},{"id":"fea9b1eb-0638-3414-a849-4088bb633bcf","vulnerability":{"id":"GHSA-698v-4r3x-3vcv","description":"launch-editor: escapeCmdArgs() omits % escaping on Windows","datePublished":"Oct 20, 2026, 6:30:24 PM","dateUpdated":"Oct 20, 2026, 6:30:24 PM","baseScore":0.0,"references":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112943\nhttps://github.com/vitejs/launch-editor/pull/155\nhttps://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc\nhttps://github.com/vitejs/launch-editor\nhttps://github.com/vitejs/launch-editor/releases/tag/v2.14.2\n","enisa_id":"EUVD-2026-105039\n","aliases":"CVE-2026-112943\nGHSA-698v-4r3x-3vcv\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}