CVE-2026-112944 launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-112944?
CVE-2026-112944 is a medium-severity vulnerability in vitejs launch-editor, published on 20 Oct 2026.
Official description
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.
Weakness: CWE-88
Which versions are affected by CVE-2026-112944?
14 open source packages ship an affected version, including launch-editor, vite and vite-plus.
| Package | Affected | Fixed in |
|---|---|---|
launch-editor npm | All versions | 2.14.2 |
launch-editor npm | All versions | 2.14.2 |
vite npm | All versions | 6.4.4 |
vite npm | All versions | 6.4.4 |
vite npm | From 7.0.0 | 7.3.7 |
vite npm | From 7.0.0 | 7.3.7 |
8 more packages
vite npm | From 8.0.0 | 8.1.6 |
vite npm | From 8.0.0 | 8.1.6 |
vite npm | From 8.2.0 | 8.2.4 |
vite npm | From 8.2.0 | 8.2.4 |
vite npm | From 8.3.0 | 8.3.3 |
vite npm | From 8.3.0 | 8.3.3 |
vite-plus npm | All versions | 1.1.0 |
vite-plus npm | All versions | 1.1.0 |
How do I fix CVE-2026-112944?
Upgrade launch-editor to 2.14.2 or later.
Is CVE-2026-112944 being exploited?
There is no known exploitation of CVE-2026-112944 in the wild and no public exploit code.
Sources
Also known as ECHO-d59c-c98f-21d4, GHSA-r825-w8mm-5pxw, MINI-36pq-v2w2-q96x, MINI-4v4q-w2rg-r3mq, MINI-5m26-256q-284c, MINI-6r8j-cqqj-xp8p and 2 more.