CVE-2026-112943 launch-editor: escapeCmdArgs() omits % escaping on Windows
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-112943?
CVE-2026-112943 is a medium-severity vulnerability in vitejs launch-editor, published on 20 Oct 2026.
Official description
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.
Weakness: CWE-78
Which versions are affected by CVE-2026-112943?
14 open source packages ship an affected version, including launch-editor, vite and vite-plus.
| Package | Affected | Fixed in |
|---|---|---|
launch-editor npm | All versions | 2.14.2 |
launch-editor npm | All versions | 2.14.2 |
vite npm | All versions | 6.4.4 |
vite npm | All versions | 6.4.4 |
vite npm | From 7.0.0 | 7.3.7 |
vite npm | From 7.0.0 | 7.3.7 |
8 more packages
vite npm | From 8.0.0 | 8.1.6 |
vite npm | From 8.0.0 | 8.1.6 |
vite npm | From 8.2.0 | 8.2.4 |
vite npm | From 8.2.0 | 8.2.4 |
vite npm | From 8.3.0 | 8.3.3 |
vite npm | From 8.3.0 | 8.3.3 |
vite-plus npm | All versions | 1.1.0 |
vite-plus npm | All versions | 1.1.0 |
How do I fix CVE-2026-112943?
Upgrade launch-editor to 2.14.2 or later.
Is CVE-2026-112943 being exploited?
There is no known exploitation of CVE-2026-112943 in the wild and no public exploit code.
Sources
Also known as ECHO-8ca6-d129-3198, GHSA-698v-4r3x-3vcv, MINI-632q-2mp5-q2v2, MINI-gch3-9hgf-j362, MINI-px3r-qj32-3857, MINI-qcg3-fx66-xm2j and 2 more.