Arbitrary Code Execution Vulnerability in Launch-Editor by Vitejs
CVE-2026-112943
6.3MEDIUM
What is CVE-2026-112943?
The launch-editor tool, utilized within Node.js environments, previously allowed users to open files with line numbers. In versions prior to 2.14.2, the tool failed to escape the '%' character on Windows systems when passing command-line arguments. This oversight allowed for the possibility of executing malicious content if an environment variable was compromised. The vulnerability has been addressed and patched in version 2.14.2, ensuring that users are no longer at risk from this exploit.
Affected Version(s)
launch-editor < 2.14.2
vite >= 8.3.0, < 8.3.3 < 8.3.0, 8.3.3
vite >= 8.2.0, < 8.2.4 < 8.2.0, 8.2.4