Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112944— launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

Quick assessment

Affected
vitejs launch-editor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

允许用户从 Node.js 环境中通过行号在编辑器中打开文件。在 2.14.2 版本之前，如果攻击者能够在当前工作目录中创建以加号（+）或减号（-）开头的文件系统条目，且选中的编辑器为受影响版本，同时路径保持相对形式或被转换为相对 WSL 路径，则 会将该路径直接转发，而未强制将其解释为位置参数（即文件名）。随后，编辑器的命令行选项解析器会将攻击者控制的文件名误识别为命令行标志（flag），从而导致所选编辑器意外覆盖文件或执行任意命令。 受影响的编辑器包括：Vim、gVim、MacVim、Emacs、Emacscl

CVSS 6.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112944

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
Source: CVE Program / CVE List V5
Vulnerability Description
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
参数注入或修改
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
vitejs launch-editor < 2.14.2 -
vitejs vite >= 8.3.0, < 8.3.3 -
vitejs vite-plus < 1.1.0 -

II. Public POCs for CVE-2026-112944

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112944

请登录查看更多情报信息。

Other References for CVE-2026-112944 (4)

Same Patch Batch · vitejs · 2026-10-20 · 6 CVEs total

CVE-2026-112942 7.5 HIGH launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
CVE-2026-112943 6.3 MEDIUM launch-editor: escapeCmdArgs() omits % escaping on Windows
CVE-2026-112947 6.3 MEDIUM Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-inst
CVE-2026-112946 6.3 MEDIUM Vite: Files outside `server.fs.allow` could be served when project paths match system path
CVE-2026-112945 2.1 LOW Vite: Cross origin script execution through Vite custom middleware

IV. Related Vulnerabilities

Same product: launch-editor
Same vendor: vitejs
Same weakness: CWE-88

V. Comments for CVE-2026-112944

No comments yet

Leave a comment