{"id":"EUVD-2026-105045","enisaUuid":"5043ca82-a553-3796-8743-01d8bc8f9be4","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.","datePublished":"Oct 20, 2026, 2:57:38 PM","dateUpdated":"Oct 20, 2026, 3:23:12 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw\nhttps://github.com/vitejs/launch-editor/pull/156\nhttps://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4\nhttps://github.com/vitejs/launch-editor/releases/tag/v2.14.2\n","aliases":"CVE-2026-112944\nGHSA-r825-w8mm-5pxw\n","assigner":"GitHub_M","epss":0.71,"enisaIdProduct":[{"id":"03953f85-14ee-3f18-9782-45b117b91fe2","product":{"name":"vite-plus","vendor":{"name":"voidzero-dev"}},"product_version":"\u003c 1.1.0"},{"id":"080fb5a2-6434-3f6b-a99f-5716bfe7ab72","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"8.0.0, \u003c 8.1.6"},{"id":"180ff59d-4e60-319b-a53c-71934e166078","product":{"name":"launch-editor","vendor":{"name":"vitejs"}},"product_version":"\u003c 2.14.2"},{"id":"7ea1c31f-770e-35de-849b-00a4afbe5863","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"8.3.0, \u003c 8.3.3"},{"id":"a14d6c0c-3f57-3781-b5cd-84ae0922d8e0","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"7.0.0, \u003c 7.3.7"},{"id":"bbafe78a-0de0-38ad-82cf-2e2a8b4f6081","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"\u003c 6.4.4"},{"id":"ca51a98c-ff52-36dd-9106-aab1239578ff","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"8.2.0, \u003c 8.2.4"}],"enisaIdVendor":[{"id":"21c4cd3b-a15b-3f8f-aee4-92aa10097b1a","vendor":{"name":"vitejs"}}],"enisaIdVulnerability":[{"id":"3363194a-f913-3a9d-a5d1-64cf0bd4958d","vulnerability":{"id":"GHSA-r825-w8mm-5pxw","description":"launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors","datePublished":"Oct 20, 2026, 7:51:52 PM","dateUpdated":"Oct 20, 2026, 7:51:53 PM","baseScore":0.0,"references":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112944\nhttps://github.com/vitejs/launch-editor/pull/156\nhttps://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4\nhttps://github.com/vitejs/launch-editor\nhttps://github.com/vitejs/launch-editor/releases/tag/v2.14.2\n","enisa_id":"EUVD-2026-105045\n","aliases":"CVE-2026-112944\nGHSA-r825-w8mm-5pxw\n","epss":0.0,"dataProcessed":"Oct 27, 2026, 7:03:17 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"db1370ef-917f-3cce-91aa-b1bee35af111","vulnerability":{"id":"CVE-2026-112944","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.","datePublished":"Oct 20, 2026, 2:57:38 PM","dateUpdated":"Oct 20, 2026, 3:23:12 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw\nhttps://github.com/vitejs/launch-editor/pull/156\nhttps://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4\nhttps://github.com/vitejs/launch-editor/releases/tag/v2.14.2\n","enisa_id":"EUVD-2026-105045\n","assigner":"GitHub_M","epss":0.71,"dataProcessed":"Oct 27, 2026, 7:14:58 AM","vulnerabilityProduct":[{"id":"98c89959-fe2a-3890-a6d3-1d7fd15ae9e9","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"8.2.0, \u003c 8.2.4"},{"id":"ad093d7d-a077-3c32-92ce-ff231c8003bb","product":{"name":"vite-plus","vendor":{"name":"voidzero-dev"}},"product_version":"\u003c 1.1.0"},{"id":"b7bde3c2-b4d7-3e83-9e7b-07cf1341048a","product":{"name":"launch-editor","vendor":{"name":"vitejs"}},"product_version":"\u003c 2.14.2"},{"id":"bb918117-31ad-3465-b82b-b1e91586dd81","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"7.0.0, \u003c 7.3.7"},{"id":"d64bfce5-8ac5-3b2a-aa09-9176de1d1c06","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"8.3.0, \u003c 8.3.3"},{"id":"e9f102f4-98fd-379c-9225-97f6e9d00757","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"\u003c 6.4.4"},{"id":"fbfaf38a-62ae-3ba7-aa8c-6a3d9fc32122","product":{"name":"vite","vendor":{"name":"vitejs"}},"product_version":"8.0.0, \u003c 8.1.6"}],"vulnerabilityVendor":[{"id":"f9e06589-3250-3c13-b033-6b4dee11996c","vendor":{"name":"vitejs"}}]}}],"enisaIdAdvisory":[]}