CVE-2026-112943
Fixed in a distro release EPSS <1%CVSS 6.3
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.
Products: vitejs launch-editor, vitejs vite, vitejs vite-plus
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | launch-editor | 2.14.2 |
| npm | vite | 8.3.3 |
| npm | vite | 8.2.4 |
| npm | vite | 8.1.6 |
| npm | vite | 7.3.7 |
| npm | vite | 6.4.4 |
| npm | vite-plus | 1.1.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | arangodb-3.12 | 3.12.12.1-r10 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.1 | 19.1.9-r0 |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.13-r0 |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.10-r0 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.9-r0 |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.9-r1 |
| Chainguard | gitlab-rails-ce-19.3 | 19.3.5-r4 |
| Chainguard | gitlab-rails-ce-19.4 | 19.4.2-r6 |
| Chainguard | gitlab-rails-ce-19.4 | 19.4.3-r0 |
| Chainguard | gitlab-rails-ce-19.5 | 19.5.1-r1 |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.9-r1 |
| Chainguard | kubeflow-pipelines-frontend | 2.17.2-r16 |
| Chainguard | langfuse-3-worker | 3.225.12-r3 |
| Chainguard | langfuse-4-worker | 4.66.0-r1 |
| Chainguard | langfuse-fips-3-worker | 3.225.12-r3 |
| Chainguard | langfuse-fips-4-worker | 4.68.0-r0 |
| Chainguard | nextcloud-server-33 | 33.0.10-r2 |
| Chainguard | nextcloud-server-34 | 34.0.5-r1 |
| Chainguard | nextcloud-server-35 | 35.0.0-r8 |
| Wolfi | kubeflow-pipelines-frontend | 2.17.2-r16 |
| Wolfi | langfuse-3-worker | 3.225.12-r3 |
| Wolfi | nextcloud-server-33 | 33.0.10-r2 |