---
id: "CVE-2026-112944"
kind: "vulnerability"
aliases: ["CVE-2026-112944", "GHSA-r825-w8mm-5pxw"]
title: "launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors"
severity: "medium"
cvss: 6.3
epss: 0.0070500001311302185
exploited: false
status: "open"
category: "package"
products: [{"name": "launch-editor", "fixed": ["2.14.2"], "affected": "<= 2.14.1", "ecosystem": "npm"}, {"name": "vite", "fixed": ["8.3.3"], "affected": ">= 8.3.0, <= 8.3.2", "ecosystem": "npm"}, {"name": "vite", "fixed": ["8.2.4"], "affected": ">= 8.2.0, <= 8.2.3", "ecosystem": "npm"}, {"name": "vite", "fixed": ["8.1.6"], "affected": ">= 8.0.0, <= 8.1.5", "ecosystem": "npm"}, {"name": "vite", "fixed": ["7.3.7"], "affected": ">= 7.0.0, <= 7.3.6", "ecosystem": "npm"}, {"name": "vite", "fixed": ["6.4.4"], "affected": "<= 6.4.3", "ecosystem": "npm"}, {"name": "vite-plus", "fixed": ["1.1.0"], "affected": "<= 1.0.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-88", "emacs", "launch-editor", "node", "package", "vim", "vite", "vite-plus", "wsl"]
not_affected_if: ["launch-editor-middleware-v2.2.0-or-later-outside-wsl", "no-untrusted-writes-to-working-directory", "no-vim-emacs-macvim-or-notepad++"]
published_at: "2026-10-20T15:17:17+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T21:57:20+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-r825-w8mm-5pxw", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112944", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

launch-editor passes file paths to editors without stripping leading + or - so a path like a flag is run as an editor command, and in Vim that means an Ex command is executed. An attacker who can create a file or directory starting with + or - in the project working directory can get the editor to run arbitrary commands or overwrite files when a developer opens it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:launch-editor affected <= 2.14.1 fixed 2.14.2
- npm:vite affected >= 8.3.0, <= 8.3.2 fixed 8.3.3
- npm:vite affected >= 8.2.0, <= 8.2.3 fixed 8.2.4
- npm:vite affected >= 8.0.0, <= 8.1.5 fixed 8.1.6
- npm:vite affected >= 7.0.0, <= 7.3.6 fixed 7.3.7
- npm:vite affected <= 6.4.3 fixed 6.4.4
- npm:vite-plus affected <= 1.0.0 fixed 1.1.0

## How to check

Run npm ls launch-editor and npm ls vite in the project to see the installed versions.
Check whether the project uses WSL or an editor such as Vim, gVim, MacVim, Emacs or Notepad++ with the launch-editor integration.
The advisory says the exposure needs an attacker who can create entries in the working directory, so check whether untrusted users or processes can write there.

## Fix

Upgrade launch-editor to 2.14.2 or later, and upgrade vite to the patched line for your branch (8.3.3, 8.2.4, 8.1.6, 7.3.7 or 6.4.4) or vite-plus to 1.1.0.
If you cannot upgrade, avoid the affected editors or stop untrusted writes to the working directory.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-r825-w8mm-5pxw
- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112944

## From the sources

### Summary

`launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.

### Impact

#### Direct `launch-editor` users

Only apps that match all of the following conditions are affected:

- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory
- The user uses or the app specifies any of the following editors:
  - Vim (including gVim)
  - MacVim
  - Emacs (including Emacsclient)
  - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
- The first argument of `launchEditor` can start with `+` or `-` or the user is using WSL

#### `launch-editor-middleware` users

Only apps that match the following conditions are affected:

- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory
- The user uses or the app specifies any of the following editors:
  - Vim (including gVim)
  - MacVim
  - Emacs (including Emacsclient)
  - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
- launch-editor older than v2.2.0 is used, or the user is using WSL

#### Vite users

Only apps that match the following conditions are affected:

- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory
- The user uses or the app specifies any of the following editors:
  - Vim (including gVim)
  - MacVim
  - Emacs (including Emacsclient)
  - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
- The user is using WSL

### Details

`launchEditor(file)` function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with `-` (also `+` for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with `+` as an Ex command. As a result, an existing relative directory such as:
```
+call writefile(["SAFE_MARKER"],"LAUNCH_EDITOR_MARKER")|qa!
```
is not treated as a filename when passed to Vim. Vim executes the embedded Ex command.

The following editor has a potentially destructive operation exposed to the CLI arguments:
- Vim (including gVim)
- MacVim
- Emacs (including Emacsclient)
- Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)

`launch-editor-middleware` v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, `launch-editor` converts the paths to relative paths internally, so those are still affected.

Vite 2.0.0+ uses `launch-editor-middleware` v2.2.0+ so the WSL users are only affected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_