CVE-2026-112943

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-112943", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-19T21:30:47.245Z", "datePublished": "2026-10-20T14:53:41.777Z", "dateUpdated": "2026-10-20T15:13:40.862Z"}, "containers": {"cna": {"title": "launch-editor: escapeCmdArgs() omits % escaping on Windows", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv"}, {"name": "https://github.com/vitejs/launch-editor/pull/155", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitejs/launch-editor/pull/155"}, {"name": "https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc"}, {"name": "https://github.com/vitejs/launch-editor/releases/tag/v2.14.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"}], "affected": [{"vendor": "vitejs", "product": "launch-editor", "versions": [{"version": "< 2.14.2", "status": "affected"}]}, {"vendor": "vitejs", "product": "vite", "versions": [{"version": ">= 8.3.0, < 8.3.3", "status": "affected"}, {"version": ">= 8.2.0, < 8.2.4", "status": "affected"}, {"version": ">= 8.0.0, < 8.1.6", "status": "affected"}, {"version": ">= 7.0.0, < 7.3.7", "status": "affected"}, {"version": "< 6.4.4", "status": "affected"}]}, {"vendor": "vitejs", "product": "vite-plus", "versions": [{"version": "< 1.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-20T14:53:41.777Z"}, "descriptions": [{"lang": "en", "value": "launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2."}], "source": {"advisory": "GHSA-698v-4r3x-3vcv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-20T15:13:29.374778Z", "id": "CVE-2026-112943", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T15:13:40.862Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-112943", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-20T15:13:29.374778Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T15:13:34.619Z"}}], "cna": {"title": "launch-editor: escapeCmdArgs() omits % escaping on Windows", "source": {"advisory": "GHSA-698v-4r3x-3vcv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "vitejs", "product": "launch-editor", "versions": [{"status": "affected", "version": "< 2.14.2"}]}, {"vendor": "vitejs", "product": "vite", "versions": [{"status": "affected", "version": ">= 8.3.0, < 8.3.3"}, {"status": "affected", "version": ">= 8.2.0, < 8.2.4"}, {"status": "affected", "version": ">= 8.0.0, < 8.1.6"}, {"status": "affected", "version": ">= 7.0.0, < 7.3.7"}, {"status": "affected", "version": "< 6.4.4"}]}, {"vendor": "vitejs", "product": "vite-plus", "versions": [{"status": "affected", "version": "< 1.1.0"}]}], "references": [{"url": "https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv", "name": "https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/vitejs/launch-editor/pull/155", "name": "https://github.com/vitejs/launch-editor/pull/155", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc", "name": "https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/vitejs/launch-editor/releases/tag/v2.14.2", "name": "https://github.com/vitejs/launch-editor/releases/tag/v2.14.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-20T14:53:41.777Z"}}}, "cveMetadata": {"cveId": "CVE-2026-112943", "state": "PUBLISHED", "dateUpdated": "2026-10-20T15:13:40.862Z", "dateReserved": "2026-10-19T21:30:47.245Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-20T14:53:41.777Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "launch-editor", "vendor": "vitejs", "versions": [{"status": "affected", "version": "< 2.14.2"}]}, {"product": "vite", "vendor": "vitejs", "versions": [{"status": "affected", "version": ">= 8.3.0, < 8.3.3"}, {"status": "affected", "version": ">= 8.2.0, < 8.2.4"}, {"status": "affected", "version": ">= 8.0.0, < 8.1.6"}, {"status": "affected", "version": ">= 7.0.0, < 7.3.7"}, {"status": "affected", "version": "< 6.4.4"}]}, {"product": "vite-plus", "vendor": "vitejs", "versions": [{"status": "affected", "version": "< 1.1.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2."}], "id": "CVE-2026-112943", "lastModified": "2026-10-20T19:55:49.343", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-112943", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-20T15:13:29.374778Z", "version": "2.0.3"}}]}, "published": "2026-10-20T15:17:17.643", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc"}, {"source": "security-advisories@github.com", "url": "https://github.com/vitejs/launch-editor/pull/155"}, {"source": "security-advisories@github.com", "url": "https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "launch-editor: launch-editor: Arbitrary code execution via improper argument escaping on Windows", "id": "2556233", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556233"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-78", "details": ["A flaw was found in launch-editor. When running on Windows systems, the package fails to properly escape percent characters when passing arguments to the Windows command shell. If an environment variable contains malicious values, an attacker could exploit this behavior to achieve arbitrary code execution on the host system."], "mitigation": {"lang": "en:us", "value": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\nThe highest-value action is to eliminate shell invocation when launching editors on Windows or enforce strict argument allowlists to avoid passing unescaped arguments directly to cmd.exe: upgrade to launch-editor 2.14.2 (or the fixed Grafana/Prometheus builds), which reject arguments containing percent signs, carriage returns, or line feeds by throwing an error instead of passing them to cmd.exe, closing all 4 injection vectors (environment-variable expansion, NTFS alternate data streams, crafted filenames, crafted relative path referencing %CD%). Until patched, this is only a concern on Windows systems running applications that pass user-controlled file paths or arguments to launch-editor \u2014 Linux and macOS deployments are unaffected \u2014 so restrict and audit who can set environment variables, prohibit placing files containing percent characters, ampersands, or line breaks in working directories, and validate file paths before invoking launch-editor. As a compensating measure, strip carriage returns and line feeds to block command separation and multiline command injection payloads passed into the Windows command shell, deploy Windows Defender Application Control in enforced mode to block unauthorized binaries an injected subcommand might drop, and restrict path characters using allowlist validation to prevent percent signs and line breaks from reaching launch-editor. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper argument escaping defect \u2014 apply the upstream patch to fully remediate.\nHighest-impact CME: CME-1307 Command Injection Prevention (No Shell Invocation) (high)"}, "name": "CVE-2026-112943", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "prometheus3.13", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-20T14:53:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-112943\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112943\nhttps://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc\nhttps://github.com/vitejs/launch-editor/pull/155\nhttps://github.com/vitejs/launch-editor/releases/tag/v2.14.2\nhttps://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.14.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "launch-editor", "source": "cna", "vendor": "vitejs"}, "product": "launch-editor", "vendor": "vitejs"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.3.0,8.3.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.2.0,8.2.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.1.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.3.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.4.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "vite", "source": "cna", "vendor": "vitejs"}, "product": "vite", "vendor": "vitejs"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "vite-plus", "source": "cna", "vendor": "vitejs"}, "product": "vite-plus", "vendor": "vitejs"}], "created": "2026-10-20T18:15:14.411638+00:00", "updated": "2026-10-20T18:30:16.817258+00:00", "vendors": ["vitejs", "vitejs$PRODUCT$launch-editor", "vitejs$PRODUCT$vite", "vitejs$PRODUCT$vite-plus"]}