CVE-2026-112943
launch-editor: escapeCmdArgs() omits % escaping on Windows
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.
| CWE | CWE-78 |
| Vendor | vitejs |
| Product | launch-editor |
| Published | Oct 20, 2026 |
| Last Updated | Oct 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for vitejs launch-editor
Be the first to know when new unknown vulnerabilities affecting vitejs launch-editor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
vitejs / launch-editor
< 2.14.2
vitejs / vite
>= 8.3.0, < 8.3.3 >= 8.2.0, < 8.2.4 >= 8.0.0, < 8.1.6 >= 7.0.0, < 7.3.7 < 6.4.4
vitejs / vite-plus
< 1.1.0
References
github.com: https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv github.com: https://github.com/vitejs/launch-editor/pull/155 github.com: https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc github.com: https://github.com/vitejs/launch-editor/releases/tag/v2.14.2