Executive brief
A vulnerability in the launch-editor library, commonly used in web development tools like Vite, allows attackers to execute unauthorized commands on a developer's Windows computer. This occurs when the tool is tricked into opening a file with a specially crafted name containing malicious characters. If exploited, an attacker could gain full control over the affected workstation, potentially leading to data theft or further network intrusion.
Technical details
A command injection vulnerability (CWE-77) exists in the launch-editor npm package when running on Windows. The root cause is insufficient sanitization of the 'file' argument within the launchEditor function, which allows special characters to break out of the intended command context. To exploit this, an attacker must be able to place a file with a malicious name on the target system and trigger the launchEditor method with that filename. This is particularly relevant for development servers where a malicious website might force a file download to a predictable path and then trigger the editor. The issue is fixed in launch-editor version 2.9.0 and Vite version 5.4.9.
Affected products
- vitejs launch-editor <= 2.8.2
- vitejs vite <= 5.4.8
Timeline
- 2026-06-01: disclosed
- 2026-06-01: patched
- 2026-06-03: advisory