Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-112942

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.

CVSS 4.0 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Vitejs
Products
Launch-editor Vite Vite-plus
CVE-2026-112943

launch-editor: escapeCmdArgs() omits % escaping on Windows

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vitejs
Products
Launch-editor Vite Vite-plus
CVE-2026-112944

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vitejs
Products
Launch-editor Vite Vite-plus
CVE-2026-53632

NTLMv2 hash disclosure via UNC path handling on Windows

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.

CVSS 4.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Vitejs
Products
Launch-editor Vite Vite-plus
CVE-2024-52011

launch-editor vulnerable to command injection via the crafted request on Windows

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Vitejs
Products
Launch-editor Vite