{"id":"CVE-2026-112944","summary":"launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors","details":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.","aliases":["GHSA-r825-w8mm-5pxw"],"modified":"2026-10-21T02:55:52.413541982Z","published":"2026-10-20T14:57:38.728Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112944.json","unresolved_ranges":[{"extracted_events":[{"range":[{"introduced":"8.3.0"},{"fixed":"8.3.3"},{"introduced":"8.2.0"},{"fixed":"8.2.4"},{"introduced":"8.0.0"},{"fixed":"8.1.6"},{"introduced":"7.0.0"},{"fixed":"7.3.7"},{"fixed":"6.4.4"},{"fixed":"1.1.0"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"}]}],"cna_assigner":"GitHub_M","cwe_ids":["CWE-88"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112944.json"},{"type":"FIX","url":"https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4"},{"type":"FIX","url":"https://github.com/vitejs/launch-editor/pull/156"},{"type":"WEB","url":"https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"},{"type":"ADVISORY","url":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112944"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vitejs/launch-editor","events":[{"introduced":"0"},{"fixed":"b5334895a00f8000ef3b6a46f2aa9e1a62eb27b4"},{"fixed":"f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"2.14.2"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4"}]},{"original_tag":"v2.14.2","range":[{"fixed":"b5334895a00f8000ef3b6a46f2aa9e1a62eb27b4"}],"source":"REFERENCES_TAG"}]}}],"versions":["v2.14.1","v2.14.0","v2.13.2","v2.13.1","v2.13.0","v2.12.0","v2.11.1","v2.11.0","v2.10.0","v2.9.1","v2.9.0","v2.8.2","v2.8.1","v2.8.0","v2.7.0","v2.6.1","v2.6.0","v2.5.0","v2.4.0","v2.3.0","v2.2.1","v2.2.0","v2.1.0","v2.0.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112944.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}]}