CVE-2026-112944: launch-editor command injection in editor invocation

CVE-2026-112944 · Severity: medium · CVSS 4 · Published 2026-10-20

launch-editor is a Node.js library that opens files in text editors with optional line numbers. If an attacker creates a filesystem entry with a name starting with plus or minus in the working directory, the library can pass it to editors like Vim or Emacs as a command-line flag instead of a filename, potentially leading to arbitrary command execution or unintended file operations.

Technologies: launch-editor (npm), vite-plus (npm), Vite Launch-Editor, Vite. Vendors: npm, Vite.

Quick answers

Is CVE-2026-112944 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-112944 being exploited in the wild.
How severe is CVE-2026-112944?
Medium severity, with a CVSS score of 4, published 20 October 2026.
Which products and versions are affected?
launch-editor (npm) <= 2.14.1, SEMVER:introduced=0,fixed=2.14.2; vite-plus (npm) <= 1.0.0, SEMVER:introduced=0,fixed=1.1.0; Vite Launch-Editor prior to 2.14.2; Vite >= 8.3.0, <= 8.3.2, SEMVER:introduced=8.3.0,fixed=8.3.3.
Is there a fix for CVE-2026-112944?
Yes. launch-editor (npm): upgrade to 2.14.2 or later; vite-plus (npm): upgrade to 1.1.0 or later; Vite: upgrade to 8.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112944 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-112944?
Check whether you run launch-editor (npm), vite-plus (npm), Vite Launch-Editor or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • launch-editor (npm): upgrade to 2.14.2 or later
    npm install launch-editor@2.14.2
  • vite-plus (npm): upgrade to 1.1.0 or later
    npm install vite-plus@1.1.0
  • Vite: upgrade to 8.3.3 or later

Technical details

The vulnerability is a command injection flaw where relative filenames beginning with '+' or '-' are not properly sanitized before being passed to editor processes. When the path is relative or converted to a relative WSL path, launchEditor forwards it without forcing absolute path resolution, allowing editor option parsing to interpret the attacker-controlled filename as a flag. This affects Vim, gVim, MacVim, Emacs, Emacsclient, and Notepad++ (with dangerous plugins), and requires that an attacker can create a malicious filesystem entry in the working directory.

Affected products

  • Vite launch-editor prior to 2.14.2

Identifiers

  • CVE-2026-112944
  • GHSA-r825-w8mm-5pxw

Timeline

  • 2026-10-20: disclosed
  • 2026-10-06: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.