---
id: CVE-2026-112944
aliases:
  - GHSA-r825-w8mm-5pxw
title: >-
  launch-editor: Editor CLI flag misinterpretation causing arbitrary command
  execution for some editors
summary: >-
  launch-editor: Editor CLI flag misinterpretation causing arbitrary command
  execution for some editors
severity: medium
cvss: 6.3
cwe:
  - CWE-88
vendor: launch-editor
product: launch-editor
ecosystem: npm
affected:
  - launch-editor <= 2.14.1
  - 'vite >= 8.3.0, <= 8.3.2'
  - 'vite >= 8.2.0, <= 8.2.3'
  - 'vite >= 8.0.0, <= 8.1.5'
  - 'vite >= 7.0.0, <= 7.3.6'
  - vite <= 6.4.3
  - vite-plus <= 1.0.0
patched:
  - launch-editor 2.14.2
  - vite 8.3.3
  - vite 8.2.4
  - vite 8.1.6
  - vite 7.3.7
  - vite 6.4.4
  - vite-plus 1.1.0
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T19:51:54Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-r825-w8mm-5pxw'
references:
  - url: >-
      https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-112944'
  - url: 'https://github.com/vitejs/launch-editor/pull/156'
  - url: >-
      https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4
  - url: 'https://github.com/vitejs/launch-editor/releases/tag/v2.14.2'
  - url: 'https://github.com/advisories/GHSA-r825-w8mm-5pxw'
tags:
  - ghsa
  - npm
  - cve.org
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-20T15:22:50.878612Z'
cvssSource: cna
ingestedAt: '2026-10-20T15:09:24.111Z'
epss: 0.00705
epssPercentile: 0.53163
---

## Overview

### Summary

`launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.

### Impact

#### Direct `launch-editor` users

Only apps that match all of the following conditions are affected:

- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory
- The user uses or the app specifies any of the following editors:
  - Vim (including gVim)
  - MacVim
  - Emacs (including Emacsclient)
  - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
- The first argument of `launchEditor` can start with `+` or `-` or the user is using WSL

#### `launch-editor-middleware` users

Only apps that match the following conditions are affected:

- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory
- The user uses or the app specifies any of the following editors:
  - Vim (including gVim)
  - MacVim
  - Emacs (including Emacsclient)
  - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
- launch-editor older than v2.2.0 is used, or the user is using WSL

#### Vite users

Only apps that match the following conditions are affected:

- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory
- The user uses or the app specifies any of the following editors:
  - Vim (including gVim)
  - MacVim
  - Emacs (including Emacsclient)
  - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
- The user is using WSL

### Details

`launchEditor(file)` function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with `-` (also `+` for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with `+` as an Ex command. As a result, an existing relative directory such as:
```
+call writefile(["SAFE_MARKER"],"LAUNCH_EDITOR_MARKER")|qa!
```
is not treated as a filename when passed to Vim. Vim executes the embedded Ex command.

The following editor has a potentially destructive operation exposed to the CLI arguments:
- Vim (including gVim)
- MacVim
- Emacs (including Emacsclient)
- Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)

`launch-editor-middleware` v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, `launch-editor` converts the paths to relative paths internally, so those are still affected.

Vite 2.0.0+ uses `launch-editor-middleware` v2.2.0+ so the WSL users are only affected.

## Affected packages

- `launch-editor <= 2.14.1`
- `vite >= 8.3.0, <= 8.3.2`
- `vite >= 8.2.0, <= 8.2.3`
- `vite >= 8.0.0, <= 8.1.5`
- `vite >= 7.0.0, <= 7.3.6`
- `vite <= 6.4.3`
- `vite-plus <= 1.0.0`

## Remediation

Upgrade to a patched release:

- `launch-editor 2.14.2`
- `vite 8.3.3`
- `vite 8.2.4`
- `vite 8.1.6`
- `vite 7.3.7`
- `vite 6.4.4`
- `vite-plus 1.1.0`