Vulnerability Intelligence Report
launch-editor: escapeCmdArgs() omits % escaping on Windows
CVE-2026-112943
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.
Injection
No Active Exploit Signals
CVSS Base Score
6.3
MEDIUM
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-78 ↗CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| vitejs | launch-editor | < 2.14.2 (affected) |
| vitejs | vite | >= 8.3.0, < 8.3.3 (affected), >= 8.2.0, < 8.2.4 (affected), >= 8.0.0, < 8.1.6 (affected), >= 7.0.0, < 7.3.7 (affected), < 6.4.4 (affected) |
| vitejs | vite-plus | < 1.1.0 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
GitHub Advisory
Vulnerability Class
Injection
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | GitHub, Inc. · Vendor · USA |
| Reserved | 2026-10-19T21:30:47 |
| Published | 2026-10-20T14:53:41 |
| Last Updated | 2026-10-20T15:13:40 |
Community Chatter & Buzz