# CVE-2026-112944: launch-editor command injection in editor invocation

Source: https://junglewise.ai/threats/cve-2026-112944-launch-editor-allows-users-to-open-files-with-line-numbers-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-112944 · Severity: medium · CVSS 4 · Published 2026-10-20

launch-editor is a Node.js library that opens files in text editors with optional line numbers. If an attacker creates a filesystem entry with a name starting with plus or minus in the working directory, the library can pass it to editors like Vim or Emacs as a command-line flag instead of a filename, potentially leading to arbitrary command execution or unintended file operations.

Technologies: [launch-editor (npm)](https://junglewise.ai/threats/technologies/npm-launch-editor), [vite-plus (npm)](https://junglewise.ai/threats/technologies/vite-plus), [Vite Launch-Editor](https://junglewise.ai/threats/technologies/launch-editor), [Vite](https://junglewise.ai/threats/technologies/npm-vite). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Vite](https://junglewise.ai/threats/vendors/vite).

## Quick answers

**Is CVE-2026-112944 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112944 being exploited in the wild.

**How severe is CVE-2026-112944?** Medium severity, with a CVSS score of 4, published 20 October 2026.

**Which products and versions are affected?** launch-editor (npm) <= 2.14.1, SEMVER:introduced=0,fixed=2.14.2; vite-plus (npm) <= 1.0.0, SEMVER:introduced=0,fixed=1.1.0; Vite Launch-Editor prior to 2.14.2; Vite >= 8.3.0, <= 8.3.2, SEMVER:introduced=8.3.0,fixed=8.3.3.

**Is there a fix for CVE-2026-112944?** Yes. launch-editor (npm): upgrade to 2.14.2 or later; vite-plus (npm): upgrade to 1.1.0 or later; Vite: upgrade to 8.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112944 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-112944?** Check whether you run launch-editor (npm), vite-plus (npm), Vite Launch-Editor or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- launch-editor (npm): upgrade to 2.14.2 or later

  ```sh
  npm install launch-editor@2.14.2
  ```

- vite-plus (npm): upgrade to 1.1.0 or later

  ```sh
  npm install vite-plus@1.1.0
  ```

- Vite: upgrade to 8.3.3 or later

## Technical details

The vulnerability is a command injection flaw where relative filenames beginning with '+' or '-' are not properly sanitized before being passed to editor processes. When the path is relative or converted to a relative WSL path, launchEditor forwards it without forcing absolute path resolution, allowing editor option parsing to interpret the attacker-controlled filename as a flag. This affects Vim, gVim, MacVim, Emacs, Emacsclient, and Notepad++ (with dangerous plugins), and requires that an attacker can create a malicious filesystem entry in the working directory.

## Affected products

- Vite launch-editor prior to 2.14.2

## Identifiers

- CVE-2026-112944
- GHSA-r825-w8mm-5pxw

## Timeline

- 2026-10-20: disclosed
- 2026-10-06: patched

## References

- [https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4](https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4)
- [https://github.com/vitejs/launch-editor/pull/156](https://github.com/vitejs/launch-editor/pull/156)

## Related threats

- [Vite development server file access bypass via query parameters](https://junglewise.ai/threats/cve-2026-118662-vite-is-a-frontend-tooling-framework-for-javascript-from-6-4-4)
- [Vitest filesystem deny misapplication in dev servers](https://junglewise.ai/threats/cve-2026-112948-vitest-is-a-testing-framework-powered-by-vite-from-5-0-0-beta-6)
- [Vite information disclosure via WebAssembly query parameter](https://junglewise.ai/threats/cve-2026-112947-vite-is-a-frontend-tooling-framework-for-javascript-from-8-2-0)
- [Vite import analysis filesystem disclosure](https://junglewise.ai/threats/cve-2026-112946-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)
- [Vite path traversal in transformIndexHtml](https://junglewise.ai/threats/cve-2026-112945-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)