---
id: "CVE-2026-112943"
kind: "vulnerability"
aliases: ["CVE-2026-112943", "GHSA-698v-4r3x-3vcv"]
title: "launch-editor: escapeCmdArgs() omits % escaping on Windows"
severity: "medium"
cvss: 6.3
epss: 0.004139999859035015
exploited: false
status: "open"
category: "package"
products: [{"name": "launch-editor", "fixed": ["2.14.2"], "affected": "<= 2.14.1", "ecosystem": "npm"}, {"name": "vite", "fixed": ["8.3.3"], "affected": ">= 8.3.0, <= 8.3.2", "ecosystem": "npm"}, {"name": "vite", "fixed": ["8.2.4"], "affected": ">= 8.2.0, <= 8.2.3", "ecosystem": "npm"}, {"name": "vite", "fixed": ["8.1.6"], "affected": ">= 8.0.0, <= 8.1.5", "ecosystem": "npm"}, {"name": "vite", "fixed": ["7.3.7"], "affected": ">= 7.0.0, <= 7.3.6", "ecosystem": "npm"}, {"name": "vite", "fixed": ["6.4.4"], "affected": "<= 6.4.3", "ecosystem": "npm"}, {"name": "vite-plus", "fixed": ["1.1.0"], "affected": "<= 1.0.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-78", "developer-machines", "launch-editor", "node", "package", "vite", "windows"]
not_affected_if: ["managed-hosting", "no-untrusted-file-writes", "non-windows-os"]
published_at: "2026-10-20T15:17:17+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T21:57:20+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-698v-4r3x-3vcv", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112943", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# launch-editor: escapeCmdArgs() omits % escaping on Windows

launch-editor, a Node library used by Vite and other dev tools to open files in an editor, does not escape % characters when passing arguments to cmd.exe on Windows. An attacker who can place a specially named file, or inject an environment variable, can get arbitrary commands executed on the developer's machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:launch-editor affected <= 2.14.1 fixed 2.14.2
- npm:vite affected >= 8.3.0, <= 8.3.2 fixed 8.3.3
- npm:vite affected >= 8.2.0, <= 8.2.3 fixed 8.2.4
- npm:vite affected >= 8.0.0, <= 8.1.5 fixed 8.1.6
- npm:vite affected >= 7.0.0, <= 7.3.6 fixed 7.3.7
- npm:vite affected <= 6.4.3 fixed 6.4.4
- npm:vite-plus affected <= 1.0.0 fixed 1.1.0

## How to check

Run npm ls launch-editor and npm ls vite in each project to see installed versions.
Check whether the project runs on Windows and whether it uses launchEditor or vite's open-in-editor feature.

## Fix

Upgrade launch-editor to 2.14.2 or later, and upgrade vite to the patched line for your major version (8.3.3, 8.2.4, 8.1.6, 7.3.7 or 6.4.4) or vite-plus to 1.1.0.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-698v-4r3x-3vcv
- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112943

## From the sources

### Summary

`launch-editor` did not escape `%` on Windows when passing an argument to `cmd`. When an environment variable contained a malicious value, it was possible that that content to be executed.

### Impact

Only apps that match all of the following conditions are affected:

- The user uses Windows
- An attacker can place a file with the malicious filename containing `&` or `%`
- Either of
  - An attacker can inject an environment variable with a malicious value
  - An attacker can add a NTFS alternate data stream to the file placed

### Details

Unlike `.sh` files, `.bat` / `.cmd` files on Windows cannot be called directly using [`child_process.spawn`](https://nodejs.org/docs/latest-v24.x/api/child_process.html#child_processspawncommand-args-options) and requires passing them as an argument of `cmd.exe`. To do so, launch-editor escapes the arguments passed to `cmd.exe`. But `launch-editor` did not escape `%` which is used for environment variables.

Because `launch-editor` checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.

- If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set ` &calc.exe ` to `%ENV%`) and call `launchEditor` with `something%ENV%`.
- If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named `~-38%calc.exe`), they can call `launchEditor` with `something %CMDCMDLINE:~-38%calc.exe`.
- If the attacker can create a filename containing the `%CD%` and the subcommand (e.g. `&calc.exe `), they can call `launchEditor` with `./%CD%`

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_