Is CVE-2026-112943 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112943 being exploited in the wild.

How severe is CVE-2026-112943?

Medium severity, with a CVSS score of 4, published 20 October 2026.

Which products and versions are affected?

launch-editor (npm) = 8.3.0, <= 8.3.2, SEMVER:introduced=8.3.0,fixed=8.3.3.

Is there a fix for CVE-2026-112943?

Yes. launch-editor (npm): upgrade to 2.14.2 or later; vite-plus (npm): upgrade to 1.1.0 or later; Vite: upgrade to 8.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-112943 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-112943?

Check whether you run launch-editor (npm), vite-plus (npm), Vite Launch-Editor or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112943: launch-editor command injection via unescaped environment variables on Windows

Q: Is there a fix for CVE-2026-112943?

Yes. launch-editor (npm): upgrade to 2.14.2 or later; vite-plus (npm): upgrade to 1.1.0 or later; Vite: upgrade to 8.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-112943 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-112943?

Check whether you run launch-editor (npm), vite-plus (npm), Vite Launch-Editor or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112943 · Severity: medium · CVSS 4 · Published 2026-10-20

launch-editor is a Node.js utility that opens files in a user's default editor with line number support. On Windows, prior to version 2.14.2, the tool failed to properly escape special characters when passing file paths to the Windows command shell, allowing attackers to inject arbitrary commands if an environment variable contained a malicious value. This could lead to arbitrary code execution on systems using affected versions.

Technologies: launch-editor (npm), vite-plus (npm), Vite Launch-Editor, Vite. Vendors: npm, Vite.

Quick answers

Is CVE-2026-112943 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112943 being exploited in the wild.
How severe is CVE-2026-112943?: Medium severity, with a CVSS score of 4, published 20 October 2026.
Which products and versions are affected?: launch-editor (npm) <= 2.14.1, SEMVER:introduced=0,fixed=2.14.2; vite-plus (npm) <= 1.0.0, SEMVER:introduced=0,fixed=1.1.0; Vite Launch-Editor before 2.14.2; Vite >= 8.3.0, <= 8.3.2, SEMVER:introduced=8.3.0,fixed=8.3.3.
Is there a fix for CVE-2026-112943?: Yes. launch-editor (npm): upgrade to 2.14.2 or later; vite-plus (npm): upgrade to 1.1.0 or later; Vite: upgrade to 8.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112943 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-112943?: Check whether you run launch-editor (npm), vite-plus (npm), Vite Launch-Editor or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

launch-editor (npm): upgrade to 2.14.2 or later
```
npm install launch-editor@2.14.2
```
vite-plus (npm): upgrade to 1.1.0 or later
```
npm install vite-plus@1.1.0
```
Vite: upgrade to 8.3.3 or later

Technical details

The vulnerability is a command injection flaw in the Windows command-line argument handling where the percent character (%) was not properly escaped before passing arguments to cmd.exe. When environment variables containing malicious payloads are used as part of file paths, attackers can break out of the intended command context and inject arbitrary commands. The fix in version 2.14.2 rejects paths containing % characters on Windows.

Affected products

Vite launch-editor before 2.14.2

Identifiers

CVE-2026-112943
GHSA-698v-4r3x-3vcv

Timeline

2026-10-20: disclosed
2026-10-06: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.