{"id":"CVE-2026-112944","aliases":["CLSA-2026-1792574714","CLSA-2026-1792582427","CLSA-2026-1793115223","CLSA-2026-1793887633","CLSA-2026-1794229655","CLSA-2026-1794406408","CLSA-2026-1794412224","EUVD-2026-105045","GHSA-r825-w8mm-5pxw"],"status":"published","title":"launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00705,"percentile":0.53796,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-88"],"published":"2026-10-20T14:57:38Z","modified":"2026-11-11T19:30:05Z","fixes":[{"ecosystem":"npm","package":"launch-editor","fixed_in":["2.14.2"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"vite","fixed_in":["8.3.3","8.2.4","8.1.6","7.3.7","6.4.4"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"vite-plus","fixed_in":["1.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"vite","fixed_in":["5.4.10-tuxcare.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"launch-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.14.1"},{"fixed":"2.14.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.3.0"},{"last_affected":"8.3.2"},{"fixed":"8.3.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.0"},{"last_affected":"8.2.3"},{"fixed":"8.2.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"last_affected":"8.1.5"},{"fixed":"8.1.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.3.6"},{"fixed":"7.3.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.4.3"},{"fixed":"6.4.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite-plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.0"},{"fixed":"1.1.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"launch-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.1-tuxcare.0"},{"fixed":"2.6.1-tuxcare.2"}]}],"versions":["2.6.1","2.6.1-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"launch-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.1-tuxcare.0"},{"fixed":"2.2.1-tuxcare.2"}]}],"versions":["2.2.1","2.2.1-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.5-tuxcare.0"},{"fixed":"4.1.5-tuxcare.4"}]}],"versions":["4.1.5","4.1.5-tuxcare.1","4.1.5-tuxcare.2","4.1.5-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.6"}]}],"versions":["2.9.18","2.9.18-tuxcare.1","2.9.18-tuxcare.2","2.9.18-tuxcare.3","2.9.18-tuxcare.4","2.9.18-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.10-tuxcare.0"},{"fixed":"5.4.10-tuxcare.6"}]}],"versions":["5.4.10","5.4.10-tuxcare.1","5.4.10-tuxcare.2","5.4.10-tuxcare.3","5.4.10-tuxcare.4","5.4.10-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite-plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.7-tuxcare.0"},{"fixed":"0.2.7-tuxcare.1"}]}],"versions":["0.2.7"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite-plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.3-tuxcare.0"},{"fixed":"0.3.3-tuxcare.1"}]}],"versions":["0.3.3"],"bundled":6},{"source":"osv","ecosystem":"npm","package":"launch-editor","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.14.2"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"8.3.0"},{"fixed":"8.3.3"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"8.2.0"},{"fixed":"8.2.4"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.1.6"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.3.7"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.4.4"}]}]},{"source":"osv","ecosystem":"npm","package":"vite-plus","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.0"}]}]}],"products":[{"vendor":"vitejs","product":"launch-editor"},{"vendor":"vitejs","product":"vite"},{"vendor":"vitejs","product":"vite-plus"},{"vendor":"voidzero-dev","product":"vite-plus"}],"references":[{"url":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/vitejs/launch-editor/pull/156","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112944","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r825-w8mm-5pxw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112944.json","tags":["advisory"]},{"url":"https://github.com/vitejs/launch-editor","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-112944","title":"launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.","status":"published","published":"2026-10-20T14:57:38.728Z","modified":"2026-10-20T15:23:12.248Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T13:44:40.64332Z"}],"euvd":[{"id":"EUVD-2026-105045","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.","status":"published","published":"2026-10-20T14:57:38Z","modified":"2026-10-20T15:23:12Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:43.975979Z"}],"ghsa":[{"id":"GHSA-r825-w8mm-5pxw","title":"launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors","description":"### Summary\n\n`launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.\n\n### Impact\n\n#### Direct `launch-editor` users\n\nOnly apps that match all of the following conditions are affected:\n\n- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory\n- The user uses or the app specifies any of the following editors:\n  - Vim (including gVim)\n  - MacVim\n  - Emacs (including Emacsclient)\n  - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)\n- The first argument of `launchEditor` can start with `+` or `-` or the user is using WSL\n\n#### `launch-editor-middleware` users\n\nOnly apps that match the following conditions are affected:\n\n- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory\n- The user uses or the app specifies any of the following editors:\n  - Vim (including gVim)\n  - MacVim\n  - Emacs (including Emacsclient)\n  - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)\n- launch-editor older than v2.2.0 is used, or the user is using WSL\n\n#### Vite users\n\nOnly apps that match the following conditions are affected:\n\n- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory\n- The user uses or the app specifies any of the following editors:\n  - Vim (including gVim)\n  - MacVim\n  - Emacs (including Emacsclient)\n  - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)\n- The user is using WSL\n\n### Details\n\n`launchEditor(file)` function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with `-` (also `+` for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with `+` as an Ex command. As a result, an existing relative directory such as:\n```\n+call writefile([\"SAFE_MARKER\"],\"LAUNCH_EDITOR_MARKER\")|qa!\n```\nis not treated as a filename when passed to Vim. Vim executes the embedded Ex command.\n\nThe following editor has a potentially destructive operation exposed to the CLI arguments:\n- Vim (including gVim)\n- MacVim\n- Emacs (including Emacsclient)\n- Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)\n\n`launch-editor-middleware` v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, `launch-editor` converts the paths to relative paths internally, so those are still affected.\n\nVite 2.0.0+ uses `launch-editor-middleware` v2.2.0+ so the WSL users are only affected.","status":"published","published":"2026-10-20T19:51:52Z","modified":"2026-10-20T19:51:54Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:41:33.669646Z"}],"nvd":[{"id":"CVE-2026-112944","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.","status":"published","published":"2026-10-20T15:17:17.793Z","modified":"2026-10-20T19:55:49.343Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:13:01.161484Z"}],"osv":[{"id":"CVE-2026-112944","title":"launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.","status":"published","published":"2026-10-20T14:57:38.728Z","modified":"2026-11-11T10:47:23.558315084Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-88"],"updated_at":"2026-11-11T03:22:00.901153Z"},{"id":"GHSA-r825-w8mm-5pxw","title":"launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors","description":"### Summary\n\n`launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.\n\n### Impact\n\n#### Direct `launch-editor` users\n\nOnly apps that match all of the following conditions are affected:\n\n- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory\n- The user uses or the app specifies any of the following editors:\n  - Vim (including gVim)\n  - MacVim\n  - Emacs (including Emacsclient)\n  - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)\n- The first argument of `launchEditor` can start with `+` or `-` or the user is using WSL\n\n#### `launch-editor-middleware` users\n\nOnly apps that match the following conditions are affected:\n\n- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory\n- The user uses or the app specifies any of the following editors:\n  - Vim (including gVim)\n  - MacVim\n  - Emacs (including Emacsclient)\n  - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)\n- launch-editor older than v2.2.0 is used, or the user is using WSL\n\n#### Vite users\n\nOnly apps that match the following conditions are affected:\n\n- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory\n- The user uses or the app specifies any of the following editors:\n  - Vim (including gVim)\n  - MacVim\n  - Emacs (including Emacsclient)\n  - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)\n- The user is using WSL\n\n### Details\n\n`launchEditor(file)` function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with `-` (also `+` for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with `+` as an Ex command. As a result, an existing relative directory such as:\n```\n+call writefile([\"SAFE_MARKER\"],\"LAUNCH_EDITOR_MARKER\")|qa!\n```\nis not treated as a filename when passed to Vim. Vim executes the embedded Ex command.\n\nThe following editor has a potentially destructive operation exposed to the CLI arguments:\n- Vim (including gVim)\n- MacVim\n- Emacs (including Emacsclient)\n- Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)\n\n`launch-editor-middleware` v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, `launch-editor` converts the paths to relative paths internally, so those are still affected.\n\nVite 2.0.0+ uses `launch-editor-middleware` v2.2.0+ so the WSL users are only affected.","status":"published","published":"2026-10-20T19:51:52Z","modified":"2026-10-20T20:00:04.608907013Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"CLSA-2026-1792574714","title":"TuxCare security update for launch-editor (3 CVEs)","description":"TuxCare rebuilt launch-editor to address 3 CVEs. Fixed in 2.6.1-tuxcare.2.","status":"published","published":"2026-10-21T09:25:14Z","modified":"2026-10-21T14:00:21.032863987Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792582427","title":"TuxCare security update for launch-editor (3 CVEs)","description":"TuxCare rebuilt launch-editor to address 3 CVEs. Fixed in 2.2.1-tuxcare.2.","status":"published","published":"2026-10-21T11:33:47Z","modified":"2026-10-21T14:00:21.923669515Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1793115223","title":"TuxCare security update for vite (4 CVEs)","description":"TuxCare rebuilt vite to address 4 CVEs. Fixed in 4.1.5-tuxcare.4.","status":"published","published":"2026-10-27T15:33:43Z","modified":"2026-10-27T19:30:06.784084796Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793887633","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 2.9.18-tuxcare.6.","status":"published","published":"2026-11-05T15:07:13Z","modified":"2026-11-06T13:15:18.547694635Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1794229655","title":"TuxCare security update for vite (1 CVE)","description":"TuxCare rebuilt vite to address 1 CVE. Fixed in 5.4.10-tuxcare.6.","status":"published","published":"2026-11-09T14:07:36Z","modified":"2026-11-09T19:15:16.090232273Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794406408","title":"TuxCare security update for vite-plus (5 CVEs)","description":"TuxCare rebuilt vite-plus to address 5 CVEs. Fixed in 0.2.7-tuxcare.1.","status":"published","published":"2026-11-11T15:13:29Z","modified":"2026-11-11T19:30:05.193587426Z","updated_at":"2026-11-11T19:50:24.684142Z"},{"id":"CLSA-2026-1794412224","title":"TuxCare security update for vite-plus (6 CVEs)","description":"TuxCare rebuilt vite-plus to address 6 CVEs. Fixed in 0.3.3-tuxcare.1.","status":"published","published":"2026-11-11T16:50:25Z","modified":"2026-11-11T19:30:04.783286761Z","updated_at":"2026-11-11T19:50:24.684142Z"}]}}