Command Injection Vulnerability in launch-editor Middleware from Vite.js
CVE-2026-112942
7.5HIGH
What is CVE-2026-112942?
The launch-editor middleware before version 2.14.2 contains a vulnerability that allows attackers to exploit file arguments containing parent-directory components, potentially leading to command injection. This occurs when the middleware improperly handles the resolution of file paths, allowing the injection payload to bypass existence checks. When combined with a known flaw related to Windows percent expansion, this can lead to further exploitation on compromised systems. The issue has been resolved in version 2.14.2.
Affected Version(s)
launch-editor < 2.14.2
vite >= 8.3.0, < 8.3.3 < 8.3.0, 8.3.3
vite >= 8.2.0, < 8.2.4 < 8.2.0, 8.2.4