# CVE-2026-112942: launch-editor path traversal validation bypass on Windows

Source: https://junglewise.ai/threats/cve-2026-112942-launch-editor-allows-users-to-open-files-with-line-numbers-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-112942 · Severity: high · CVSS 4 · Published 2026-10-20

launch-editor is a Node.js utility that opens files in an editor with line-number support, commonly used in development tooling. A vulnerability in Windows file handling allows attackers to bypass filename validation by using directory traversal sequences, potentially enabling arbitrary OS command execution when combined with other flaws. This affects development environments and build tools that integrate launch-editor.

Technologies: [launch-editor (npm)](https://junglewise.ai/threats/technologies/npm-launch-editor), [vite-plus (npm)](https://junglewise.ai/threats/technologies/vite-plus), [Vite Launch-Editor](https://junglewise.ai/threats/technologies/launch-editor), [Vite](https://junglewise.ai/threats/technologies/npm-vite). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Vite](https://junglewise.ai/threats/vendors/vite).

## Quick answers

**Is CVE-2026-112942 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112942 being exploited in the wild.

**How severe is CVE-2026-112942?** High severity, with a CVSS score of 4, published 20 October 2026.

**Which products and versions are affected?** launch-editor (npm) <= 2.14.1, SEMVER:introduced=0,fixed=2.14.2; vite-plus (npm) <= 1.0.0, SEMVER:introduced=0,fixed=1.1.0; Vite Launch-Editor before 2.14.2; Vite >= 8.3.0, <= 8.3.2, SEMVER:introduced=8.3.0,fixed=8.3.3.

**Is there a fix for CVE-2026-112942?** Yes. launch-editor (npm): upgrade to 2.14.2 or later; vite-plus (npm): upgrade to 1.1.0 or later; Vite: upgrade to 8.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112942 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-112942?** Check whether you run launch-editor (npm), vite-plus (npm), Vite Launch-Editor or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- launch-editor (npm): upgrade to 2.14.2 or later

  ```sh
  npm install launch-editor@2.14.2
  ```

- vite-plus (npm): upgrade to 1.1.0 or later

  ```sh
  npm install vite-plus@1.1.0
  ```

- Vite: upgrade to 8.3.3 or later

## Technical details

The vulnerability is a path traversal validation bypass in launch-editor-middleware prior to 2.14.2. On Windows, when a file argument contains a parent-directory component plus a line-and-column suffix, the path is resolved while the suffix remains present; the suffix is then stripped before the existsSync check, leaving only the parent directory for validation. This allows an attacker-controlled filename to pass existence validation without the malicious file existing, and can lead to OS command injection when paired with Windows percent-expansion flaws. The fix checks file existence after path resolution.

## Affected products

- Vite launch-editor before 2.14.2

## Identifiers

- CVE-2026-112942
- GHSA-587h-7wmj-h5pm

## Timeline

- 2026-10-20: disclosed
- 2026-10-06: patched: Release v2.14.2

## References

- [https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679](https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679)
- [https://github.com/vitejs/launch-editor/releases/tag/v2.14.2](https://github.com/vitejs/launch-editor/releases/tag/v2.14.2)

## Related threats

- [Vite development server file access bypass via query parameters](https://junglewise.ai/threats/cve-2026-118662-vite-is-a-frontend-tooling-framework-for-javascript-from-6-4-4)
- [Vitest filesystem deny misapplication in dev servers](https://junglewise.ai/threats/cve-2026-112948-vitest-is-a-testing-framework-powered-by-vite-from-5-0-0-beta-6)
- [Vite information disclosure via WebAssembly query parameter](https://junglewise.ai/threats/cve-2026-112947-vite-is-a-frontend-tooling-framework-for-javascript-from-8-2-0)
- [Vite import analysis filesystem disclosure](https://junglewise.ai/threats/cve-2026-112946-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)
- [Vite path traversal in transformIndexHtml](https://junglewise.ai/threats/cve-2026-112945-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)