PT-2026-134556

TuxCare rebuilt launch-editor to address 3 CVEs. Fixed in 2.6.1-tuxcare.2...

CVE-2026-112942

A flaw was found in launch-editor. This vulnerability can allow a remote attacker to achieve arbitrary command execution on Windows systems. By submitting a specially crafted file path containing line and column suffixes, an attacker can bypass file existence checks due to improper path validatio...

CVE-2026-112943

A flaw was found in launch-editor. When running on Windows systems, the package fails to properly escape percent characters when passing arguments to the Windows command shell. If an environment variable contains malicious values, an attacker could exploit this behavior to achieve arbitrary code...

Arbitrary Argument Injection

Overview org.webjars.npm:vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Arbitrary Argument Injection via the getArgumentsForFile function in packages/launch-editor/get-args.js, where a filename is passed directly to an editor process without...

npm: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

npm: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors vulnerability discovered by ? in WordPress npm vite versions = 6.4.3...

npm: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

npm: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors vulnerability discovered by ? in WordPress npm launch-editor versions = 2.14.1...

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

Summary launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution. Impact Direct launch-editor users Only apps that match all of t...

3nit-utils (>=0.24.0, <=1.0.2), 6ix (0.0.0-canary.0) +317 more potentially affected by CVE-2026-112944 via launch-editor (>=2.2.1, <=2.14.1)

launch-editor NPM version =2.2.1, =0.24.0, =0.0.0-canary.0, =0.0.1, =7.0.2, =1.0.0, =0.4.0, =0.1.0, =0.3.0, =1.0.0, =0.2.0, =0.2.10 - @carnesen/www 0.1.0 - @catapult-tech/cp-design-system-site 1.0.0 - @caviar/cli 0.0.1 and more Source cves: CVE-2026-112944 Source advisory:...

Arbitrary Argument Injection

Overview org.webjars.npm:launch-editor is a launch editor from node.js Affected versions of this package are vulnerable to Arbitrary Argument Injection via the getArgumentsForFile function in packages/launch-editor/get-args.js, where a filename is passed directly to an editor process without bein...

GHSA-R825-W8MM-5PXW launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

Summary launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution. Impact Direct launch-editor users Only apps that match all of t...

npm: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

npm: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors vulnerability discovered by ? in WordPress npm vite-plus versions = 1.0.0...

3nit-utils (>=0.24.0, <=1.0.2), 6ix (0.0.0-canary.0) +317 more potentially affected by CVE-2026-112944 via launch-editor (>=2.2.1, <=2.14.1)

launch-editor NPM version =2.2.1, =0.24.0, =0.0.0-canary.0, =0.0.1, =7.0.2, =1.0.0, =0.4.0, =0.1.0, =0.3.0, =1.0.0, =0.2.0, =0.2.10 - @carnesen/www 0.1.0 - @catapult-tech/cp-design-system-site 1.0.0 - @caviar/cli 0.0.1 and more Source cves: CVE-2026-112944 Source advisory: OSV:GHSA-R825-W8MM-5PXW...

3nit-utils (>=0.24.0, <=1.0.2), 6ix (0.0.0-canary.0) +317 more potentially affected by CVE-2026-112944 via launch-editor (>=2.2.1, <=2.14.1)

launch-editor NPM version =2.2.1, =0.24.0, =0.0.0-canary.0, =0.0.1, =7.0.2, =1.0.0, =0.4.0, =0.1.0, =0.3.0, =1.0.0, =0.2.0, =0.2.10 - @carnesen/www 0.1.0 - @catapult-tech/cp-design-system-site 1.0.0 - @caviar/cli 0.0.1 and more Source cves: CVE-2026-112944 Source advisory: GHSA-R825-W8MM-5PXW...

Arbitrary Argument Injection

Overview vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Arbitrary Argument Injection via the getArgumentsForFile function in packages/launch-editor/get-args.js, where a filename is passed directly to an editor process without being resolved to ...

Arbitrary Argument Injection

Overview launch-editor is a launch editor from node.js Affected versions of this package are vulnerable to Arbitrary Argument Injection via the getArgumentsForFile function in packages/launch-editor/get-args.js, where a filename is passed directly to an editor process without being resolved to an...

Arbitrary Argument Injection

Overview vite-plus is a The Unified Toolchain for the Web Affected versions of this package are vulnerable to Arbitrary Argument Injection via the getArgumentsForFile function in packages/launch-editor/get-args.js, where a filename is passed directly to an editor process without being resolved to...

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

Summary launch-editor checked fs.existsSyncfileName before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in \..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename...

3nit-utils (>=0.24.0, <=1.0.2), 6ix (0.0.0-canary.0) +317 more potentially affected by CVE-2026-112942 via launch-editor (>=2.2.1, <=2.14.1)

launch-editor NPM version =2.2.1, =0.24.0, =0.0.0-canary.0, =0.0.1, =7.0.2, =1.0.0, =0.4.0, =0.1.0, =0.3.0, =1.0.0, =0.2.0, =0.2.10 - @carnesen/www 0.1.0 - @catapult-tech/cp-design-system-site 1.0.0 - @caviar/cli 0.0.1 and more Source cves: CVE-2026-112942 Source advisory: GHSA-587H-7WMJ-H5PM...

3nit-utils (>=0.24.0, <=1.0.2), 6ix (0.0.0-canary.0) +317 more potentially affected by CVE-2026-112942 via launch-editor (>=2.2.1, <=2.14.1)

launch-editor NPM version =2.2.1, =0.24.0, =0.0.0-canary.0, =0.0.1, =7.0.2, =1.0.0, =0.4.0, =0.1.0, =0.3.0, =1.0.0, =0.2.0, =0.2.10 - @carnesen/www 0.1.0 - @catapult-tech/cp-design-system-site 1.0.0 - @caviar/cli 0.0.1 and more Source cves: CVE-2026-112942 Source advisory: OSV:GHSA-587H-7WMJ-H5PM...

Arbitrary Command Injection

Overview vite-plus is a The Unified Toolchain for the Web Affected versions of this package are vulnerable to Arbitrary Command Injection via the parseFile function in packages/launch-editor/index.js, which previously resolved file paths only after stripping position suffixes without calling...