CVE-2026-112944
Received Received - Intake

launchEditor Path Traversal Leading to Arbitrary File Overwrite in Vim and gVim

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112944
EUVD
EUVD-2026-105045

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
vitejs launch-editor < 2.14.2
vitejs vite >= 8.3.0, < 8.3.3
vitejs vite >= 8.2.0, < 8.2.4
vitejs vite >= 8.0.0, < 8.1.6
vitejs vite >= 7.0.0, < 7.3.7
vitejs vite < 6.4.4
vitejs vite-plus < 1.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in launch-editor allows attackers to execute arbitrary commands or overwrite files by creating filenames starting with + or -. When these filenames are passed to vulnerable editors like Vim, Emacs, or Notepad++ (with certain plugins), the editors misinterpret the filenames as command-line flags, leading to unintended behavior.

Detection Guidance

Check if your system uses vulnerable versions of launch-editor (<=2.14.1), vite (>=8.3.0, <=8.3.2), or vite-plus (<=1.0.0) by running commands like 'npm list launch-editor', 'npm list vite', or 'npm list vite-plus'. Inspect file paths passed to editors for entries starting with '+' or '-' in working directories.

Impact Analysis

If you use vulnerable versions of launch-editor, vite, or vite-plus, an attacker who can create files with names starting with + or - in your working directory could execute arbitrary commands or overwrite files when you open those files in an editor. This requires network access but no privileges or user interaction.

Mitigation Strategies

Update launch-editor to version 2.14.2 or higher, vite to 8.3.3 or higher, and vite-plus to 1.1.0 or higher. Avoid creating files starting with '+' or '-' in directories where editors are launched. Use absolute paths prefixed with './' when passing filenames to editors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112944. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart