Command Execution Vulnerability in Launch-Editor by Vite

CVE-2026-112944

What is CVE-2026-112944?

The Launch-Editor tool has a vulnerability that allows attackers to manipulate file paths leading to potential command-line flag parsing. When an attacker creates a filesystem entry that begins with a plus or minus and specifies the working directory, it may allow the path to either stay relative or transition to a relative Windows Subsystem for Linux (WSL) path. This manipulation permits the selected editor to treat the attacker-controlled filename as a command-line argument, paving the way for file overwrites or arbitrary command execution. This issue affects various text editors, including Vim, gVim, MacVim, and Emacs, as well as Notepad++ when susceptible plugins are in use. To rectify these vulnerabilities, upgrading to Launch-Editor version 2.14.2 or later is strongly recommended.

References