{"id":"CVE-2026-112942","aliases":["CLSA-2026-1792574714","CLSA-2026-1792582427","CLSA-2026-1793887392","CLSA-2026-1793887633","CLSA-2026-1793973624","CLSA-2026-1793973716","CLSA-2026-1794406408","CLSA-2026-1794412224","EUVD-2026-105035","GHSA-587h-7wmj-h5pm","ROOT-APP-NPM-CVE-2026-112942"],"status":"published","title":"launch-editor: `fs.existsSync()` existence check can be bypassed on Windows","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.","severity":{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01694,"percentile":0.77465,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2026-10-20T14:48:06Z","modified":"2026-11-11T19:30:05Z","fixes":[{"ecosystem":"npm","package":"launch-editor","fixed_in":["2.14.2"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"vite","fixed_in":["8.3.3","8.2.4","8.1.6","7.3.7","6.4.4"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"vite-plus","fixed_in":["1.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"vite","fixed_in":["8.2.1-aikido.1","6.4.1-aikido.4","8.2.2-aikido.1","8.3.2-aikido.1","8.2.0-aikido.1","5.4.21-aikido.4","6.4.3-aikido.1","8.3.0-aikido.1","8.3.1-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"launch-editor","fixed_in":["2.14.1-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/vite","fixed_in":["8.2.1-root.io.1","6.4.1-root.io.4","8.2.2-root.io.1","8.3.2-root.io.1","8.2.0-root.io.1","5.4.21-root.io.4","6.4.3-root.io.1","8.3.0-root.io.1","8.3.1-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/launch-editor","fixed_in":["2.14.1-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"launch-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.14.1"},{"fixed":"2.14.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.3.0"},{"last_affected":"8.3.2"},{"fixed":"8.3.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.0"},{"last_affected":"8.2.3"},{"fixed":"8.2.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"last_affected":"8.1.5"},{"fixed":"8.1.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.3.6"},{"fixed":"7.3.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.4.3"},{"fixed":"6.4.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite-plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.0"},{"fixed":"1.1.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"launch-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.1-tuxcare.0"},{"fixed":"2.6.1-tuxcare.2"}]}],"versions":["2.6.1","2.6.1-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"launch-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.1-tuxcare.0"},{"fixed":"2.2.1-tuxcare.2"}]}],"versions":["2.2.1","2.2.1-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.11-tuxcare.0"},{"fixed":"3.2.11-tuxcare.9"}]}],"versions":["3.2.11","3.2.11-tuxcare.1","3.2.11-tuxcare.2","3.2.11-tuxcare.3","3.2.11-tuxcare.4","3.2.11-tuxcare.5","3.2.11-tuxcare.6","3.2.11-tuxcare.7","3.2.11-tuxcare.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.6"}]}],"versions":["2.9.18","2.9.18-tuxcare.1","2.9.18-tuxcare.2","2.9.18-tuxcare.3","2.9.18-tuxcare.4","2.9.18-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.7"}]}],"versions":["4.5.0","4.5.0-tuxcare.1","4.5.0-tuxcare.2","4.5.0-tuxcare.3","4.5.0-tuxcare.4","4.5.0-tuxcare.5","4.5.0-tuxcare.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.5-tuxcare.0"},{"fixed":"4.5.5-tuxcare.11"}]}],"versions":["4.5.5","4.5.5-tuxcare.1","4.5.5-tuxcare.10","4.5.5-tuxcare.2","4.5.5-tuxcare.3","4.5.5-tuxcare.4","4.5.5-tuxcare.5","4.5.5-tuxcare.6","4.5.5-tuxcare.7","4.5.5-tuxcare.8","4.5.5-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite-plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.7-tuxcare.0"},{"fixed":"0.2.7-tuxcare.1"}]}],"versions":["0.2.7"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite-plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.3-tuxcare.0"},{"fixed":"0.3.3-tuxcare.1"}]}],"versions":["0.3.3"],"bundled":6},{"source":"osv","ecosystem":"npm","package":"launch-editor","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.14.2"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"8.3.0"},{"fixed":"8.3.3"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"8.2.0"},{"fixed":"8.2.4"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.1.6"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.3.7"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.4.4"}]}]},{"source":"osv","ecosystem":"npm","package":"vite-plus","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.1-aikido.1"},{"fixed":"6.4.1-aikido.4"},{"fixed":"8.2.2-aikido.1"},{"fixed":"8.3.2-aikido.1"},{"fixed":"8.2.0-aikido.1"},{"fixed":"5.4.21-aikido.4"},{"fixed":"6.4.3-aikido.1"},{"fixed":"8.3.0-aikido.1"},{"fixed":"8.3.1-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"launch-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.1-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.1-root.io.1"},{"fixed":"6.4.1-root.io.4"},{"fixed":"8.2.2-root.io.1"},{"fixed":"8.3.2-root.io.1"},{"fixed":"8.2.0-root.io.1"},{"fixed":"5.4.21-root.io.4"},{"fixed":"6.4.3-root.io.1"},{"fixed":"8.3.0-root.io.1"},{"fixed":"8.3.1-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/launch-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.1-root.io.1"}]}]}],"products":[{"vendor":"vitejs","product":"launch-editor"},{"vendor":"vitejs","product":"vite"},{"vendor":"vitejs","product":"vite-plus"},{"vendor":"voidzero-dev","product":"vite-plus"}],"references":[{"url":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112942","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-587h-7wmj-h5pm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112942.json","tags":["advisory"]},{"url":"https://github.com/vitejs/launch-editor","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-112942","title":"launch-editor: `fs.existsSync()` existence check can be bypassed on Windows","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.","status":"published","published":"2026-10-20T14:48:06.676Z","modified":"2026-10-21T15:55:05.963Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T13:44:51.734189Z"}],"euvd":[{"id":"EUVD-2026-105035","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.","status":"published","published":"2026-10-20T14:48:06Z","modified":"2026-10-21T15:55:05Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:59:36.721365Z"}],"ghsa":[{"id":"GHSA-587h-7wmj-h5pm","title":"launch-editor: `fs.existsSync()` existence check can be bypassed on Windows","description":"### Summary\n\n`launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in `\\\\..:line:column`. This removes the requirement that the attacker be able to place a file with a malicious filename.\n\nCombined with the `%` escaping issue described in [GHSA-698v-4r3x-3vcv](https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv), this bypass can lead to OS command injection when an attacker controls the file argument.\n\n### Impact\n\nOnly apps that runs on Windows is affected.\n\n### Details\n\nThe earlier advisory assumed that `fs.existsSync()` required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement.\n\nA crafted value ending in `\\\\..:1:1` is interpreted differently by `launch-editor-middleware`, `launch-editor`, and Windows:\n\n1. `launch-editor-middleware` calls `path.resolve()` while the final path component is `..:1:1`, so it is not treated as a parent-directory component.\n2. `launch-editor` treats `:1:1` as a line-and-column suffix and removes it, leaving a path ending in `\\\\..`.\n3. On Windows, `fs.existsSync()` accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist.\n4. Because the existence check passes, the crafted filename reaches the Windows shell command.","status":"published","published":"2026-10-20T19:48:25Z","modified":"2026-10-20T19:48:26Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:41:33.669646Z"}],"nvd":[{"id":"CVE-2026-112942","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.","status":"published","published":"2026-10-20T15:17:17.23Z","modified":"2026-10-21T16:17:15.207Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:13:01.161484Z"}],"osv":[{"id":"CVE-2026-112942","title":"launch-editor: `fs.existsSync()` existence check can be bypassed on Windows","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.","status":"published","published":"2026-10-20T14:48:06.676Z","modified":"2026-10-28T02:30:47.800768748Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:44:56.310988Z"},{"id":"GHSA-587h-7wmj-h5pm","title":"launch-editor: `fs.existsSync()` existence check can be bypassed on Windows","description":"### Summary\n\n`launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in `\\\\..:line:column`. This removes the requirement that the attacker be able to place a file with a malicious filename.\n\nCombined with the `%` escaping issue described in [GHSA-698v-4r3x-3vcv](https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv), this bypass can lead to OS command injection when an attacker controls the file argument.\n\n### Impact\n\nOnly apps that runs on Windows is affected.\n\n### Details\n\nThe earlier advisory assumed that `fs.existsSync()` required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement.\n\nA crafted value ending in `\\\\..:1:1` is interpreted differently by `launch-editor-middleware`, `launch-editor`, and Windows:\n\n1. `launch-editor-middleware` calls `path.resolve()` while the final path component is `..:1:1`, so it is not treated as a parent-directory component.\n2. `launch-editor` treats `:1:1` as a line-and-column suffix and removes it, leaving a path ending in `\\\\..`.\n3. On Windows, `fs.existsSync()` accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist.\n4. Because the existence check passes, the crafted filename reaches the Windows shell command.","status":"published","published":"2026-10-20T19:48:25Z","modified":"2026-10-20T20:00:04.60897984Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"CLSA-2026-1792574714","title":"TuxCare security update for launch-editor (3 CVEs)","description":"TuxCare rebuilt launch-editor to address 3 CVEs. Fixed in 2.6.1-tuxcare.2.","status":"published","published":"2026-10-21T09:25:14Z","modified":"2026-10-21T14:00:21.032863987Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792582427","title":"TuxCare security update for launch-editor (3 CVEs)","description":"TuxCare rebuilt launch-editor to address 3 CVEs. Fixed in 2.2.1-tuxcare.2.","status":"published","published":"2026-10-21T11:33:47Z","modified":"2026-10-21T14:00:21.923669515Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1793887392","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 3.2.11-tuxcare.9.","status":"published","published":"2026-11-05T15:03:13Z","modified":"2026-11-06T13:15:17.596779689Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793887633","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 2.9.18-tuxcare.6.","status":"published","published":"2026-11-05T15:07:13Z","modified":"2026-11-06T13:15:18.547694635Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793973624","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 4.5.0-tuxcare.7.","status":"published","published":"2026-11-06T15:00:25Z","modified":"2026-11-06T19:00:02.354161224Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1793973716","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 4.5.5-tuxcare.11.","status":"published","published":"2026-11-06T15:01:57Z","modified":"2026-11-06T19:00:03.378849658Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1794406408","title":"TuxCare security update for vite-plus (5 CVEs)","description":"TuxCare rebuilt vite-plus to address 5 CVEs. Fixed in 0.2.7-tuxcare.1.","status":"published","published":"2026-11-11T15:13:29Z","modified":"2026-11-11T19:30:05.193587426Z","updated_at":"2026-11-11T19:50:24.684142Z"},{"id":"CLSA-2026-1794412224","title":"TuxCare security update for vite-plus (6 CVEs)","description":"TuxCare rebuilt vite-plus to address 6 CVEs. Fixed in 0.3.3-tuxcare.1.","status":"published","published":"2026-11-11T16:50:25Z","modified":"2026-11-11T19:30:04.783286761Z","updated_at":"2026-11-11T19:50:24.684142Z"},{"id":"ROOT-APP-NPM-CVE-2026-112942","title":"CVE-2026-112942 in vite - Patched by Root","description":"Root has patched CVE-2026-112942 in the vite package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-28T04:55:33Z","modified":"2026-10-28T05:15:02.812035115Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}