# CVE-2026-112943: launch-editor command injection via unescaped environment variables on Windows

Source: https://junglewise.ai/threats/cve-2026-112943-launch-editor-allows-users-to-open-files-with-line-numbers-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-112943 · Severity: medium · CVSS 4 · Published 2026-10-20

launch-editor is a Node.js utility that opens files in a user's default editor with line number support. On Windows, prior to version 2.14.2, the tool failed to properly escape special characters when passing file paths to the Windows command shell, allowing attackers to inject arbitrary commands if an environment variable contained a malicious value. This could lead to arbitrary code execution on systems using affected versions.

Technologies: [launch-editor (npm)](https://junglewise.ai/threats/technologies/npm-launch-editor), [vite-plus (npm)](https://junglewise.ai/threats/technologies/vite-plus), [Vite Launch-Editor](https://junglewise.ai/threats/technologies/launch-editor), [Vite](https://junglewise.ai/threats/technologies/npm-vite). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Vite](https://junglewise.ai/threats/vendors/vite).

## Quick answers

**Is CVE-2026-112943 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112943 being exploited in the wild.

**How severe is CVE-2026-112943?** Medium severity, with a CVSS score of 4, published 20 October 2026.

**Which products and versions are affected?** launch-editor (npm) <= 2.14.1, SEMVER:introduced=0,fixed=2.14.2; vite-plus (npm) <= 1.0.0, SEMVER:introduced=0,fixed=1.1.0; Vite Launch-Editor before 2.14.2; Vite >= 8.3.0, <= 8.3.2, SEMVER:introduced=8.3.0,fixed=8.3.3.

**Is there a fix for CVE-2026-112943?** Yes. launch-editor (npm): upgrade to 2.14.2 or later; vite-plus (npm): upgrade to 1.1.0 or later; Vite: upgrade to 8.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112943 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-112943?** Check whether you run launch-editor (npm), vite-plus (npm), Vite Launch-Editor or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- launch-editor (npm): upgrade to 2.14.2 or later

  ```sh
  npm install launch-editor@2.14.2
  ```

- vite-plus (npm): upgrade to 1.1.0 or later

  ```sh
  npm install vite-plus@1.1.0
  ```

- Vite: upgrade to 8.3.3 or later

## Technical details

The vulnerability is a command injection flaw in the Windows command-line argument handling where the percent character (%) was not properly escaped before passing arguments to cmd.exe. When environment variables containing malicious payloads are used as part of file paths, attackers can break out of the intended command context and inject arbitrary commands. The fix in version 2.14.2 rejects paths containing % characters on Windows.

## Affected products

- Vite launch-editor before 2.14.2

## Identifiers

- CVE-2026-112943
- GHSA-698v-4r3x-3vcv

## Timeline

- 2026-10-20: disclosed
- 2026-10-06: patched

## References

- [https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc](https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc)
- [https://github.com/vitejs/launch-editor/pull/155](https://github.com/vitejs/launch-editor/pull/155)

## Related threats

- [Vite development server file access bypass via query parameters](https://junglewise.ai/threats/cve-2026-118662-vite-is-a-frontend-tooling-framework-for-javascript-from-6-4-4)
- [Vitest filesystem deny misapplication in dev servers](https://junglewise.ai/threats/cve-2026-112948-vitest-is-a-testing-framework-powered-by-vite-from-5-0-0-beta-6)
- [Vite information disclosure via WebAssembly query parameter](https://junglewise.ai/threats/cve-2026-112947-vite-is-a-frontend-tooling-framework-for-javascript-from-8-2-0)
- [Vite import analysis filesystem disclosure](https://junglewise.ai/threats/cve-2026-112946-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)
- [Vite path traversal in transformIndexHtml](https://junglewise.ai/threats/cve-2026-112945-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)