---
id: "CVE-2026-112942"
kind: "vulnerability"
aliases: ["CVE-2026-112942", "GHSA-587h-7wmj-h5pm"]
title: "launch-editor: `fs.existsSync()` existence check can be bypassed on Windows"
severity: "high"
cvss: 7.5
epss: 0.013290000148117542
exploited: false
status: "open"
category: "package"
products: [{"name": "launch-editor", "fixed": ["2.14.2"], "affected": "<= 2.14.1", "ecosystem": "npm"}, {"name": "vite", "fixed": ["8.3.3"], "affected": ">= 8.3.0, <= 8.3.2", "ecosystem": "npm"}, {"name": "vite", "fixed": ["8.2.4"], "affected": ">= 8.2.0, <= 8.2.3", "ecosystem": "npm"}, {"name": "vite", "fixed": ["8.1.6"], "affected": ">= 8.0.0, <= 8.1.5", "ecosystem": "npm"}, {"name": "vite", "fixed": ["7.3.7"], "affected": ">= 7.0.0, <= 7.3.6", "ecosystem": "npm"}, {"name": "vite", "fixed": ["6.4.4"], "affected": "<= 6.4.3", "ecosystem": "npm"}, {"name": "vite-plus", "fixed": ["1.1.0"], "affected": "<= 1.0.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-77", "dev-server", "launch-editor", "package", "vite", "vite-plus", "windows"]
not_affected_if: ["no-launch-editor-middleware", "non-windows"]
published_at: "2026-10-20T15:17:17+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T21:57:20+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-587h-7wmj-h5pm", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112942", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

On Windows, launch-editor's existence check can be bypassed with a crafted path ending in \..:line:column, so the path reaches the editor shell command. Combined with a separate % escaping issue (GHSA-698v-4r3x-3vcv), an attacker who controls the file argument can run OS commands.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:launch-editor affected <= 2.14.1 fixed 2.14.2
- npm:vite affected >= 8.3.0, <= 8.3.2 fixed 8.3.3
- npm:vite affected >= 8.2.0, <= 8.2.3 fixed 8.2.4
- npm:vite affected >= 8.0.0, <= 8.1.5 fixed 8.1.6
- npm:vite affected >= 7.0.0, <= 7.3.6 fixed 7.3.7
- npm:vite affected <= 6.4.3 fixed 6.4.4
- npm:vite-plus affected <= 1.0.0 fixed 1.1.0

## How to check

Run npm ls launch-editor vite vite-plus to list installed versions and compare them to the affected ranges.
Exposure also requires a Windows host running the dev server or launch-editor-middleware.

## Fix

Upgrade launch-editor to 2.14.2 or later, and vite to 8.3.3, 8.2.4, 8.1.6, 7.3.7 or 6.4.4 depending on your branch. Upgrade vite-plus to 1.1.0 or later.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-587h-7wmj-h5pm
- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112942

## From the sources

### Summary

`launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in `\\..:line:column`. This removes the requirement that the attacker be able to place a file with a malicious filename.

Combined with the `%` escaping issue described in [GHSA-698v-4r3x-3vcv](https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv), this bypass can lead to OS command injection when an attacker controls the file argument.

### Impact

Only apps that runs on Windows is affected.

### Details

The earlier advisory assumed that `fs.existsSync()` required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement.

A crafted value ending in `\\..:1:1` is interpreted differently by `launch-editor-middleware`, `launch-editor`, and Windows:

1. `launch-editor-middleware` calls `path.resolve()` while the final path component is `..:1:1`, so it is not treated as a parent-directory component.
2. `launch-editor` treats `:1:1` as a line-and-column suffix and removes it, leaving a path ending in `\\..`.
3. On Windows, `fs.existsSync()` accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist.
4. Because the existence check passes, the crafted filename reaches the Windows shell command.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_