{"id":"CVE-2026-112944","kind":"vulnerability","aliases":["CVE-2026-112944","GHSA-r825-w8mm-5pxw"],"related":[],"title":"launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors","description":"### Summary\n\n`launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.\n\n### Impact\n\n#### Direct `launch-editor` users\n\nOnly apps that match all of the following conditions are affected:\n\n- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory\n- The user uses or the app specifies any of the following editors:\n  - Vim (including gVim)\n  - MacVim\n  - Emacs (including Emacsclient)\n  - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)\n- The first argument of `launchEditor` can start with `+` or `-` or the user is using WSL\n\n#### `launch-editor-middleware` users\n\nOnly apps that match the following conditions are affected:\n\n- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory\n- The user uses or the app specifies any of the following editors:\n  - Vim (including gVim)\n  - MacVim\n  - Emacs (including Emacsclient)\n  - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)\n- launch-editor older than v2.2.0 is used, or the user is using WSL\n\n#### Vite users\n\nOnly apps that match the following conditions are affected:\n\n- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory\n- The user uses or the app specifies any of the following editors:\n  - Vim (including gVim)\n  - MacVim\n  - Emacs (including Emacsclient)\n  - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)\n- The user is using WSL\n\n### Details\n\n`launchEditor(file)` function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with `-` (also `+` for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with `+` as an Ex command. As a result, an existing relative directory such as:\n```\n+call writefile([\"SAFE_MARKER\"],\"LAUNCH_EDITOR_MARKER\")|qa!\n```\nis not treated as a filename when passed to Vim. Vim executes the embedded Ex command.\n\nThe following editor has a potentially destructive operation exposed to the CLI arguments:\n- Vim (including gVim)\n- MacVim\n- Emacs (including Emacsclient)\n- Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)\n\n`launch-editor-middleware` v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, `launch-editor` converts the paths to relative paths internally, so those are still affected.\n\nVite 2.0.0+ uses `launch-editor-middleware` v2.2.0+ so the WSL users are only affected.","summary":"launch-editor passes file paths to editors without stripping leading + or - so a path like a flag is run as an editor command, and in Vim that means an Ex command is executed. An attacker who can create a file or directory starting with + or - in the project working directory can get the editor to run arbitrary commands or overwrite files when a developer opens it.","severity":"medium","cvss":6.3,"epss":0.0070500001311302185,"exploited":false,"exploited_at":null,"products":[{"name":"launch-editor","fixed":["2.14.2"],"affected":"<= 2.14.1","ecosystem":"npm"},{"name":"vite","fixed":["8.3.3"],"affected":">= 8.3.0, <= 8.3.2","ecosystem":"npm"},{"name":"vite","fixed":["8.2.4"],"affected":">= 8.2.0, <= 8.2.3","ecosystem":"npm"},{"name":"vite","fixed":["8.1.6"],"affected":">= 8.0.0, <= 8.1.5","ecosystem":"npm"},{"name":"vite","fixed":["7.3.7"],"affected":">= 7.0.0, <= 7.3.6","ecosystem":"npm"},{"name":"vite","fixed":["6.4.4"],"affected":"<= 6.4.3","ecosystem":"npm"},{"name":"vite-plus","fixed":["1.1.0"],"affected":"<= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-88","emacs","launch-editor","node","package","vim","vite","vite-plus","wsl"],"not_affected_if":["launch-editor-middleware-v2.2.0-or-later-outside-wsl","no-untrusted-writes-to-working-directory","no-vim-emacs-macvim-or-notepad++"],"how_to_check":"Run npm ls launch-editor and npm ls vite in the project to see the installed versions.\nCheck whether the project uses WSL or an editor such as Vim, gVim, MacVim, Emacs or Notepad++ with the launch-editor integration.\nThe advisory says the exposure needs an attacker who can create entries in the working directory, so check whether untrusted users or processes can write there.","fix":"Upgrade launch-editor to 2.14.2 or later, and upgrade vite to the patched line for your branch (8.3.3, 8.2.4, 8.1.6, 7.3.7 or 6.4.4) or vite-plus to 1.1.0.\nIf you cannot upgrade, avoid the affected editors or stop untrusted writes to the working directory.","status":"open","published_at":"2026-10-20T15:17:17+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:13:30+00:00","updated_at":"2026-10-23T21:57:20+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T20:13:30Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade launch-editor to 2.14.2 or later, and upgrade vite to the patched line for your branch (8.3.3, 8.2.4, 8.1.6, 7.3.7 or 6.4.4) or vite-plus to 1.1.0.\nIf you cannot upgrade, avoid the affected editors or stop untrusted writes to the working directory.","summary":"launch-editor passes file paths to editors without stripping leading + or - so a path like a flag is run as an editor command, and in Vim that means an Ex command is executed. An attacker who can create a file or directory starting with + or - in the project working directory can get the editor to run arbitrary commands or overwrite files when a developer opens it.","category":"package","who_cares":["vite","launch-editor","vite-plus","wsl","vim","emacs","node"],"confidence":0.8,"analyst_note":"","how_to_check":"Run npm ls launch-editor and npm ls vite in the project to see the installed versions.\nCheck whether the project uses WSL or an editor such as Vim, gVim, MacVim, Emacs or Notepad++ with the launch-editor integration.\nThe advisory says the exposure needs an attacker who can create entries in the working directory, so check whether untrusted users or processes can write there.","needs_analyst":false,"not_affected_if":["launch-editor-middleware-v2.2.0-or-later-outside-wsl","no-vim-emacs-macvim-or-notepad++","no-untrusted-writes-to-working-directory"],"severity_if_unknown":"unknown"},"cost_usd":0.000586,"input_tokens":3186,"output_tokens":535,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112944':17A,25A '-2026':16A,24A '-88':38B '2.0.0':551C '5pxw':22A 'abl':173C,255C,333C 'absolut':517C 'affect':169C,251C,329C,523C,549C,564C 'also':416C 'app':160C,197C,244C,279C,322C,357C 'arbitrari':9A,108B 'argument':225C,428C,433C,485C 'as-i':396C 'attack':86B,171C,253C,331C 'call':449C 'caus':8A,146C 'cli':5A,134C,484C 'command':10A,74B,82B,109B,144C,151C,439C,472C 'condit':167C,249C,327C 'convert':510C,538C 'creat':89B,175C,257C,335C 'cve':15A,23A 'cwe':37B 'danger':218C,300C,378C,500C 'destruct':479C 'detail':388C 'develop':115B 'direct':124C,154C 'directori':93B,101B,184C,191C,266C,273C,344C,351C,446C 'e.g':180C,262C,340C 'editor':3A,4A,14A,28A,42B,53B,58B,73B,105B,120C,126C,136C,157C,203C,240C,285C,307C,363C,401C,420C,454C,475C,507C,537C,555C 'emac':39B,208C,290C,368C,490C 'emacscli':210C,292C,370C,492C 'embed':470C 'entri':179C,261C,339C 'ex':81B,438C,471C 'exampl':430C 'execut':11A,84B,152C,468C 'exist':409C,444C 'expos':217C,299C,377C,481C,499C 'file':55B,91B,112B,122C,148C,177C,182C,259C,264C,337C,342C,390C,394C,404C,407C,412C,513C 'filenam':462C 'first':224C 'flag':6A,68B,135C,424C 'follow':166C,202C,248C,284C,326C,362C,474C 'forward':121C 'function':391C 'get':103B 'ghsa':19A 'ghsa-r825-w8mm-5pxw':18A 'gvim':206C,288C,366C,488C 'impact':153C 'includ':205C,209C,287C,291C,365C,369C,487C,491C 'intern':544C 'interpret':140C 'launch':2A,27A,41B,52B,119C,156C,239C,306C,453C,506C,536C,554C 'launch-editor':1A,26A,40B,51B,118C,155C,305C,535C 'launch-editor-middlewar':238C,505C,553C 'launcheditor':227C,389C 'lead':61B 'like':66B,137C 'long':525C 'macvim':207C,289C,367C,489C 'marker':452C,455C 'match':162C,246C,324C 'may':139C 'mean':79B 'messag':222C,304C,382C,504C 'middlewar':241C,508C,556C 'misinterpret':7A 'name':395C,408C,413C 'node':43B 'notepad':211C,293C,371C,493C 'older':308C 'open':116B 'oper':219C,301C,379C,480C,501C 'overwrit':111B,149C 'packag':44B 'pass':54B,392C,464C,512C 'path':56B,65B,123C,131C,514C,518C,540C,543C 'plugin':216C,221C,298C,303C,376C,381C,498C,503C 'plus':36A,49B 'posit':427C 'potenti':145C,478C 'project':99B 'qa':456C 'r825':20A 'rather':425C 'relat':445C,542C 'resembl':132C 'result':442C 'run':70B,107B 'safe':451C 'sanit':128C 'specifi':198C,280C,358C 'start':94B,185C,229C,267C,345C,414C,434C 'still':548C 'strip':60B 'summari':117C 'system':178C,260C,338C 'treat':421C,432C,459C 'unintend':147C 'use':194C,214C,236C,276C,296C,312C,317C,354C,374C,386C,496C,531C,552C 'user':158C,193C,234C,242C,275C,315C,320C,353C,384C,528C,561C 'v2.2.0':310C,509C,557C 'via':220C,302C,380C,502C 'vim':45B,77B,138C,204C,286C,364C,418C,431C,466C,467C,486C 'vite':29A,30A,31A,32A,33A,35A,46B,48B,319C,550C 'vite-plus':34A,47B 'w8mm':21A 'without':59B,127C 'work':100B,190C,272C,350C 'writefil':450C 'wsl':50B,237C,318C,387C,532C,534C,560C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T15:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-r825-w8mm-5pxw","url":"https://github.com/advisories/GHSA-r825-w8mm-5pxw","severity":"medium","published_at":"2026-10-20T19:51:52+00:00","modified_at":"2026-10-20T19:51:54+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-112944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112944","severity":null,"published_at":"2026-10-20T15:17:17+00:00","modified_at":"2026-10-20T19:55:49+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}