RCE in Vitejs Launch-Editor
CVE-2026-112943
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Vitejs Launch-Editor — versions < 2.14.2
- Vitejs Vite — versions < 6.4.4, >= 7.0.0, < 7.3.7, >= 8.0.0, < 8.1.6
- Vitejs Vite-Plus — versions < 1.1.0