Is CVE-2026-112942 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112942 being exploited in the wild.

How severe is CVE-2026-112942?

High severity, with a CVSS score of 4, published 20 October 2026.

Which products and versions are affected?

launch-editor (npm) = 8.3.0, <= 8.3.2, SEMVER:introduced=8.3.0,fixed=8.3.3.

Is there a fix for CVE-2026-112942?

Yes. launch-editor (npm): upgrade to 2.14.2 or later; vite-plus (npm): upgrade to 1.1.0 or later; Vite: upgrade to 8.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-112942 attacked?

It is attacked with local access.

Am I affected by CVE-2026-112942?

Check whether you run launch-editor (npm), vite-plus (npm), Vite Launch-Editor or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112942: launch-editor path traversal validation bypass on Windows

Q: Is there a fix for CVE-2026-112942?

Yes. launch-editor (npm): upgrade to 2.14.2 or later; vite-plus (npm): upgrade to 1.1.0 or later; Vite: upgrade to 8.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-112942 attacked?

It is attacked with local access.

Q: Am I affected by CVE-2026-112942?

Check whether you run launch-editor (npm), vite-plus (npm), Vite Launch-Editor or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112942 · Severity: high · CVSS 4 · Published 2026-10-20

launch-editor is a Node.js utility that opens files in an editor with line-number support, commonly used in development tooling. A vulnerability in Windows file handling allows attackers to bypass filename validation by using directory traversal sequences, potentially enabling arbitrary OS command execution when combined with other flaws. This affects development environments and build tools that integrate launch-editor.

Technologies: launch-editor (npm), vite-plus (npm), Vite Launch-Editor, Vite. Vendors: npm, Vite.

Quick answers

Is CVE-2026-112942 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112942 being exploited in the wild.
How severe is CVE-2026-112942?: High severity, with a CVSS score of 4, published 20 October 2026.
Which products and versions are affected?: launch-editor (npm) <= 2.14.1, SEMVER:introduced=0,fixed=2.14.2; vite-plus (npm) <= 1.0.0, SEMVER:introduced=0,fixed=1.1.0; Vite Launch-Editor before 2.14.2; Vite >= 8.3.0, <= 8.3.2, SEMVER:introduced=8.3.0,fixed=8.3.3.
Is there a fix for CVE-2026-112942?: Yes. launch-editor (npm): upgrade to 2.14.2 or later; vite-plus (npm): upgrade to 1.1.0 or later; Vite: upgrade to 8.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112942 attacked?: It is attacked with local access.
Am I affected by CVE-2026-112942?: Check whether you run launch-editor (npm), vite-plus (npm), Vite Launch-Editor or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

launch-editor (npm): upgrade to 2.14.2 or later
```
npm install launch-editor@2.14.2
```
vite-plus (npm): upgrade to 1.1.0 or later
```
npm install vite-plus@1.1.0
```
Vite: upgrade to 8.3.3 or later

Technical details

The vulnerability is a path traversal validation bypass in launch-editor-middleware prior to 2.14.2. On Windows, when a file argument contains a parent-directory component plus a line-and-column suffix, the path is resolved while the suffix remains present; the suffix is then stripped before the existsSync check, leaving only the parent directory for validation. This allows an attacker-controlled filename to pass existence validation without the malicious file existing, and can lead to OS command injection when paired with Windows percent-expansion flaws. The fix checks file existence after path resolution.

Affected products

Vite launch-editor before 2.14.2

Identifiers

CVE-2026-112942
GHSA-587h-7wmj-h5pm

Timeline

2026-10-20: disclosed
2026-10-06: patched: Release v2.14.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.