{"id":"CVE-2026-112943","aliases":["CLSA-2026-1792574714","CLSA-2026-1792582427","CLSA-2026-1793115223","CLSA-2026-1793887392","CLSA-2026-1794406408","CLSA-2026-1794412224","EUVD-2026-105039","GHSA-698v-4r3x-3vcv"],"status":"published","title":"launch-editor: escapeCmdArgs() omits % escaping on Windows","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00414,"percentile":0.36222,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2026-10-20T14:53:41Z","modified":"2026-11-11T19:30:05Z","fixes":[{"ecosystem":"npm","package":"launch-editor","fixed_in":["2.14.2"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"vite","fixed_in":["8.3.3","8.2.4","8.1.6","7.3.7","6.4.4"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"vite-plus","fixed_in":["1.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"launch-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.14.1"},{"fixed":"2.14.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.3.0"},{"last_affected":"8.3.2"},{"fixed":"8.3.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.0"},{"last_affected":"8.2.3"},{"fixed":"8.2.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"last_affected":"8.1.5"},{"fixed":"8.1.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.3.6"},{"fixed":"7.3.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.4.3"},{"fixed":"6.4.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite-plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.0"},{"fixed":"1.1.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"launch-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.1-tuxcare.0"},{"fixed":"2.6.1-tuxcare.2"}]}],"versions":["2.6.1","2.6.1-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"launch-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.1-tuxcare.0"},{"fixed":"2.2.1-tuxcare.2"}]}],"versions":["2.2.1","2.2.1-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.5-tuxcare.0"},{"fixed":"4.1.5-tuxcare.4"}]}],"versions":["4.1.5","4.1.5-tuxcare.1","4.1.5-tuxcare.2","4.1.5-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.11-tuxcare.0"},{"fixed":"3.2.11-tuxcare.9"}]}],"versions":["3.2.11","3.2.11-tuxcare.1","3.2.11-tuxcare.2","3.2.11-tuxcare.3","3.2.11-tuxcare.4","3.2.11-tuxcare.5","3.2.11-tuxcare.6","3.2.11-tuxcare.7","3.2.11-tuxcare.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite-plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.7-tuxcare.0"},{"fixed":"0.2.7-tuxcare.1"}]}],"versions":["0.2.7"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite-plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.3-tuxcare.0"},{"fixed":"0.3.3-tuxcare.1"}]}],"versions":["0.3.3"],"bundled":6},{"source":"osv","ecosystem":"npm","package":"launch-editor","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.14.2"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"8.3.0"},{"fixed":"8.3.3"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"8.2.0"},{"fixed":"8.2.4"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.1.6"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.3.7"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.4.4"}]}]},{"source":"osv","ecosystem":"npm","package":"vite-plus","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.0"}]}]}],"products":[{"vendor":"vitejs","product":"launch-editor"},{"vendor":"vitejs","product":"vite"},{"vendor":"vitejs","product":"vite-plus"},{"vendor":"voidzero-dev","product":"vite-plus"}],"references":[{"url":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/vitejs/launch-editor/pull/155","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112943","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-698v-4r3x-3vcv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112943.json","tags":["advisory"]},{"url":"https://github.com/vitejs/launch-editor","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-112943","title":"launch-editor: escapeCmdArgs() omits % escaping on Windows","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.","status":"published","published":"2026-10-20T14:53:41.777Z","modified":"2026-10-20T15:13:40.862Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T13:44:51.734189Z"}],"euvd":[{"id":"EUVD-2026-105039","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.","status":"published","published":"2026-10-20T14:53:41Z","modified":"2026-10-20T15:13:40Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:43.975979Z"}],"ghsa":[{"id":"GHSA-698v-4r3x-3vcv","title":"launch-editor: escapeCmdArgs() omits % escaping on Windows","description":"### Summary\n\n`launch-editor` did not escape `%` on Windows when passing an argument to `cmd`. When an environment variable contained a malicious value, it was possible that that content to be executed.\n\n### Impact\n\nOnly apps that match all of the following conditions are affected:\n\n- The user uses Windows\n- An attacker can place a file with the malicious filename containing `\u0026` or `%`\n- Either of\n  - An attacker can inject an environment variable with a malicious value\n  - An attacker can add a NTFS alternate data stream to the file placed\n\n### Details\n\nUnlike `.sh` files, `.bat` / `.cmd` files on Windows cannot be called directly using [`child_process.spawn`](https://nodejs.org/docs/latest-v24.x/api/child_process.html#child_processspawncommand-args-options) and requires passing them as an argument of `cmd.exe`. To do so, launch-editor escapes the arguments passed to `cmd.exe`. But `launch-editor` did not escape `%` which is used for environment variables.\n\nBecause `launch-editor` checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.\n\n- If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set ` \u0026calc.exe ` to `%ENV%`) and call `launchEditor` with `something%ENV%`.\n- If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named `~-38%calc.exe`), they can call `launchEditor` with `something %CMDCMDLINE:~-38%calc.exe`.\n- If the attacker can create a filename containing the `%CD%` and the subcommand (e.g. `\u0026calc.exe `), they can call `launchEditor` with `./%CD%`","status":"published","published":"2026-10-20T18:30:24Z","modified":"2026-10-20T18:30:25Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:41:33.669646Z"}],"nvd":[{"id":"CVE-2026-112943","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.","status":"published","published":"2026-10-20T15:17:17.643Z","modified":"2026-10-20T19:55:49.343Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:13:01.161484Z"}],"osv":[{"id":"CVE-2026-112943","title":"launch-editor: escapeCmdArgs() omits % escaping on Windows","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.","status":"published","published":"2026-10-20T14:53:41.777Z","modified":"2026-10-28T02:30:50.996973357Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:44:56.310988Z"},{"id":"GHSA-698v-4r3x-3vcv","title":"launch-editor: escapeCmdArgs() omits % escaping on Windows","description":"### Summary\n\n`launch-editor` did not escape `%` on Windows when passing an argument to `cmd`. When an environment variable contained a malicious value, it was possible that that content to be executed.\n\n### Impact\n\nOnly apps that match all of the following conditions are affected:\n\n- The user uses Windows\n- An attacker can place a file with the malicious filename containing `\u0026` or `%`\n- Either of\n  - An attacker can inject an environment variable with a malicious value\n  - An attacker can add a NTFS alternate data stream to the file placed\n\n### Details\n\nUnlike `.sh` files, `.bat` / `.cmd` files on Windows cannot be called directly using [`child_process.spawn`](https://nodejs.org/docs/latest-v24.x/api/child_process.html#child_processspawncommand-args-options) and requires passing them as an argument of `cmd.exe`. To do so, launch-editor escapes the arguments passed to `cmd.exe`. But `launch-editor` did not escape `%` which is used for environment variables.\n\nBecause `launch-editor` checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.\n\n- If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set ` \u0026calc.exe ` to `%ENV%`) and call `launchEditor` with `something%ENV%`.\n- If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named `~-38%calc.exe`), they can call `launchEditor` with `something %CMDCMDLINE:~-38%calc.exe`.\n- If the attacker can create a filename containing the `%CD%` and the subcommand (e.g. `\u0026calc.exe `), they can call `launchEditor` with `./%CD%`","status":"published","published":"2026-10-20T18:30:24Z","modified":"2026-10-20T18:45:09.467993691Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"CLSA-2026-1792574714","title":"TuxCare security update for launch-editor (3 CVEs)","description":"TuxCare rebuilt launch-editor to address 3 CVEs. Fixed in 2.6.1-tuxcare.2.","status":"published","published":"2026-10-21T09:25:14Z","modified":"2026-10-21T14:00:21.032863987Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792582427","title":"TuxCare security update for launch-editor (3 CVEs)","description":"TuxCare rebuilt launch-editor to address 3 CVEs. Fixed in 2.2.1-tuxcare.2.","status":"published","published":"2026-10-21T11:33:47Z","modified":"2026-10-21T14:00:21.923669515Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1793115223","title":"TuxCare security update for vite (4 CVEs)","description":"TuxCare rebuilt vite to address 4 CVEs. Fixed in 4.1.5-tuxcare.4.","status":"published","published":"2026-10-27T15:33:43Z","modified":"2026-10-27T19:30:06.784084796Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793887392","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 3.2.11-tuxcare.9.","status":"published","published":"2026-11-05T15:03:13Z","modified":"2026-11-06T13:15:17.596779689Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1794406408","title":"TuxCare security update for vite-plus (5 CVEs)","description":"TuxCare rebuilt vite-plus to address 5 CVEs. Fixed in 0.2.7-tuxcare.1.","status":"published","published":"2026-11-11T15:13:29Z","modified":"2026-11-11T19:30:05.193587426Z","updated_at":"2026-11-11T19:50:24.684142Z"},{"id":"CLSA-2026-1794412224","title":"TuxCare security update for vite-plus (6 CVEs)","description":"TuxCare rebuilt vite-plus to address 6 CVEs. Fixed in 0.3.3-tuxcare.1.","status":"published","published":"2026-11-11T16:50:25Z","modified":"2026-11-11T19:30:04.783286761Z","updated_at":"2026-11-11T19:50:24.684142Z"}]}}