{"id":"CVE-2026-112942","kind":"vulnerability","aliases":["CVE-2026-112942","GHSA-587h-7wmj-h5pm"],"related":[],"title":"launch-editor: `fs.existsSync()` existence check can be bypassed on Windows","description":"### Summary\n\n`launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in `\\\\..:line:column`. This removes the requirement that the attacker be able to place a file with a malicious filename.\n\nCombined with the `%` escaping issue described in [GHSA-698v-4r3x-3vcv](https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv), this bypass can lead to OS command injection when an attacker controls the file argument.\n\n### Impact\n\nOnly apps that runs on Windows is affected.\n\n### Details\n\nThe earlier advisory assumed that `fs.existsSync()` required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement.\n\nA crafted value ending in `\\\\..:1:1` is interpreted differently by `launch-editor-middleware`, `launch-editor`, and Windows:\n\n1. `launch-editor-middleware` calls `path.resolve()` while the final path component is `..:1:1`, so it is not treated as a parent-directory component.\n2. `launch-editor` treats `:1:1` as a line-and-column suffix and removes it, leaving a path ending in `\\\\..`.\n3. On Windows, `fs.existsSync()` accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist.\n4. Because the existence check passes, the crafted filename reaches the Windows shell command.","summary":"On Windows, launch-editor's existence check can be bypassed with a crafted path ending in \\..:line:column, so the path reaches the editor shell command. Combined with a separate % escaping issue (GHSA-698v-4r3x-3vcv), an attacker who controls the file argument can run OS commands.","severity":"high","cvss":7.5,"epss":0.013290000148117542,"exploited":false,"exploited_at":null,"products":[{"name":"launch-editor","fixed":["2.14.2"],"affected":"<= 2.14.1","ecosystem":"npm"},{"name":"vite","fixed":["8.3.3"],"affected":">= 8.3.0, <= 8.3.2","ecosystem":"npm"},{"name":"vite","fixed":["8.2.4"],"affected":">= 8.2.0, <= 8.2.3","ecosystem":"npm"},{"name":"vite","fixed":["8.1.6"],"affected":">= 8.0.0, <= 8.1.5","ecosystem":"npm"},{"name":"vite","fixed":["7.3.7"],"affected":">= 7.0.0, <= 7.3.6","ecosystem":"npm"},{"name":"vite","fixed":["6.4.4"],"affected":"<= 6.4.3","ecosystem":"npm"},{"name":"vite-plus","fixed":["1.1.0"],"affected":"<= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-77","dev-server","launch-editor","package","vite","vite-plus","windows"],"not_affected_if":["no-launch-editor-middleware","non-windows"],"how_to_check":"Run npm ls launch-editor vite vite-plus to list installed versions and compare them to the affected ranges.\nExposure also requires a Windows host running the dev server or launch-editor-middleware.","fix":"Upgrade launch-editor to 2.14.2 or later, and vite to 8.3.3, 8.2.4, 8.1.6, 7.3.7 or 6.4.4 depending on your branch. Upgrade vite-plus to 1.1.0 or later.","status":"open","published_at":"2026-10-20T15:17:17+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:13:32+00:00","updated_at":"2026-10-23T21:57:20+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T20:13:32Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade launch-editor to 2.14.2 or later, and vite to 8.3.3, 8.2.4, 8.1.6, 7.3.7 or 6.4.4 depending on your branch. Upgrade vite-plus to 1.1.0 or later.","summary":"On Windows, launch-editor's existence check can be bypassed with a crafted path ending in \\..:line:column, so the path reaches the editor shell command. Combined with a separate % escaping issue (GHSA-698v-4r3x-3vcv), an attacker who controls the file argument can run OS commands.","category":"package","who_cares":["launch-editor","vite","vite-plus","windows","dev-server"],"confidence":0.8,"analyst_note":"","how_to_check":"Run npm ls launch-editor vite vite-plus to list installed versions and compare them to the affected ranges.\nExposure also requires a Windows host running the dev server or launch-editor-middleware.","needs_analyst":false,"not_affected_if":["non-windows","no-launch-editor-middleware"],"severity_if_unknown":"unknown"},"cost_usd":0.000829,"input_tokens":2666,"output_tokens":1124,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112942':14A,22A '-2026':13A,21A '-77':35B '/vitejs/launch-editor/security/advisories/ghsa-698v-4r3x-3vcv),':160C '1':213C,214C,228C,241C,242C,259C,260C '2':254C '3':276C '3vcv':85B,157C '4':300C '4r3x':84B,156C '587h':17A '698v':83B,155C '7wmj':18A 'abl':137C 'accept':280C 'advisori':188C,201C 'affect':184C 'app':178C 'argument':92B,175C 'assum':189C 'attack':87B,116C,135C,171C,195C,293C 'attacker-control':194C,292C 'bypass':9A,58B,118C,162C,204C 'call':233C 'check':6A,55B,101C,120C,304C 'column':66B,128C,266C 'combin':75B,146C 'command':74B,96B,112C,167C,313C 'compon':239C,253C,296C 'control':89B,172C,196C,294C 'cover':202C 'craft':61B,123C,209C,307C 'cve':12A,20A 'cwe':34B 'describ':151C 'detail':185C 'dev':37B 'dev-serv':36B 'differ':217C 'directori':252C,288C 'earlier':187C 'editor':3A,25A,41B,52B,72B,100C,111C,221C,225C,231C,257C 'end':63B,125C,211C,274C 'escap':79B,149C 'even':289C 'exist':5A,54B,199C,286C,299C,303C 'file':91B,141C,174C 'filenam':103C,145C,197C,308C 'final':237C 'fs.existssync':4A,102C,191C,279C 'ghsa':16A,82B,154C 'ghsa-587h-7wmj-h5pm':15A 'ghsa-698v-4r3x-3vcv':81B,153C 'github.com':159C 'github.com/vitejs/launch-editor/security/advisories/ghsa-698v-4r3x-3vcv),':158C 'h5pm':19A 'impact':176C 'inject':168C 'interpret':216C 'issu':80B,150C 'launch':2A,24A,40B,51B,99C,220C,224C,230C,256C 'launch-editor':1A,23A,39B,50B,98C,223C,255C 'launch-editor-middlewar':219C,229C 'lead':164C 'leav':271C 'line':65B,127C,264C 'line-and-column':263C 'malici':144C 'middlewar':222C,232C 'os':95B,166C 'packag':42B 'parent':251C,287C 'parent-directori':250C 'pass':105C,305C 'path':62B,69B,108C,124C,238C,273C,283C 'path.resolve':234C 'place':139C 'plus':33A,46B 'preced':295C 'reach':70B,309C 'remov':130C,269C 'requir':132C,192C,207C 'result':282C 'run':94B,180C 'separ':78B 'server':38B 'shell':73B,312C 'suffix':267C 'summari':97C 'suppli':107C 'though':290C 'treat':247C,258C 'valu':210C 'vite':26A,27A,28A,29A,30A,32A,43B,45B 'vite-plus':31A,44B 'window':11A,47B,49B,114C,182C,227C,278C,311C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T15:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-587h-7wmj-h5pm","url":"https://github.com/advisories/GHSA-587h-7wmj-h5pm","severity":"high","published_at":"2026-10-20T19:48:25+00:00","modified_at":"2026-10-20T19:48:26+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-112942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112942","severity":null,"published_at":"2026-10-20T15:17:17+00:00","modified_at":"2026-10-21T16:17:15+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}