CVE-2026-112944

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-112944", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-19T21:30:47.245Z", "datePublished": "2026-10-20T14:57:38.728Z", "dateUpdated": "2026-10-20T15:23:12.248Z"}, "containers": {"cna": {"title": "launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors", "problemTypes": [{"descriptions": [{"cweId": "CWE-88", "lang": "en", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw"}, {"name": "https://github.com/vitejs/launch-editor/pull/156", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitejs/launch-editor/pull/156"}, {"name": "https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4"}, {"name": "https://github.com/vitejs/launch-editor/releases/tag/v2.14.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"}], "affected": [{"vendor": "vitejs", "product": "launch-editor", "versions": [{"version": "< 2.14.2", "status": "affected"}]}, {"vendor": "vitejs", "product": "vite", "versions": [{"version": ">= 8.3.0, < 8.3.3", "status": "affected"}, {"version": ">= 8.2.0, < 8.2.4", "status": "affected"}, {"version": ">= 8.0.0, < 8.1.6", "status": "affected"}, {"version": ">= 7.0.0, < 7.3.7", "status": "affected"}, {"version": "< 6.4.4", "status": "affected"}]}, {"vendor": "vitejs", "product": "vite-plus", "versions": [{"version": "< 1.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-20T14:57:38.728Z"}, "descriptions": [{"lang": "en", "value": "launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2."}], "source": {"advisory": "GHSA-r825-w8mm-5pxw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-20T15:22:50.878612Z", "id": "CVE-2026-112944", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T15:23:12.248Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-112944", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-20T15:22:50.878612Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T15:23:00.635Z"}}], "cna": {"title": "launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors", "source": {"advisory": "GHSA-r825-w8mm-5pxw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "vitejs", "product": "launch-editor", "versions": [{"status": "affected", "version": "< 2.14.2"}]}, {"vendor": "vitejs", "product": "vite", "versions": [{"status": "affected", "version": ">= 8.3.0, < 8.3.3"}, {"status": "affected", "version": ">= 8.2.0, < 8.2.4"}, {"status": "affected", "version": ">= 8.0.0, < 8.1.6"}, {"status": "affected", "version": ">= 7.0.0, < 7.3.7"}, {"status": "affected", "version": "< 6.4.4"}]}, {"vendor": "vitejs", "product": "vite-plus", "versions": [{"status": "affected", "version": "< 1.1.0"}]}], "references": [{"url": "https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw", "name": "https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/vitejs/launch-editor/pull/156", "name": "https://github.com/vitejs/launch-editor/pull/156", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4", "name": "https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/vitejs/launch-editor/releases/tag/v2.14.2", "name": "https://github.com/vitejs/launch-editor/releases/tag/v2.14.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-88", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-20T14:57:38.728Z"}}}, "cveMetadata": {"cveId": "CVE-2026-112944", "state": "PUBLISHED", "dateUpdated": "2026-10-20T15:23:12.248Z", "dateReserved": "2026-10-19T21:30:47.245Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-20T14:57:38.728Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "launch-editor", "vendor": "vitejs", "versions": [{"status": "affected", "version": "< 2.14.2"}]}, {"product": "vite", "vendor": "vitejs", "versions": [{"status": "affected", "version": ">= 8.3.0, < 8.3.3"}, {"status": "affected", "version": ">= 8.2.0, < 8.2.4"}, {"status": "affected", "version": ">= 8.0.0, < 8.1.6"}, {"status": "affected", "version": ">= 7.0.0, < 7.3.7"}, {"status": "affected", "version": "< 6.4.4"}]}, {"product": "vite-plus", "vendor": "vitejs", "versions": [{"status": "affected", "version": "< 1.1.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2."}], "id": "CVE-2026-112944", "lastModified": "2026-10-20T19:55:49.343", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-112944", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-20T15:22:50.878612Z", "version": "2.0.3"}}]}, "published": "2026-10-20T15:17:17.793", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4"}, {"source": "security-advisories@github.com", "url": "https://github.com/vitejs/launch-editor/pull/156"}, {"source": "security-advisories@github.com", "url": "https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-88"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "launch-editor: launch-editor: Arbitrary command execution via improper filename handling", "id": "2556285", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556285"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-88", "details": ["A flaw was found in launch-editor. This vulnerability can lead to arbitrary command execution or unintended file overwrite due to improper handling of file paths when invoking external text editors. An attacker capable of creating files with leading special characters in the working directory can cause the editor to interpret the filename as a command-line flag rather than a positional file target."], "name": "CVE-2026-112944", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "prometheus3.13", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-20T14:57:38Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-112944\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112944\nhttps://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4\nhttps://github.com/vitejs/launch-editor/pull/156\nhttps://github.com/vitejs/launch-editor/releases/tag/v2.14.2\nhttps://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.14.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "launch-editor", "source": "cna", "vendor": "vitejs"}, "product": "launch-editor", "vendor": "vitejs"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.3.0,8.3.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.2.0,8.2.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.1.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.3.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.4.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "vite", "source": "cna", "vendor": "vitejs"}, "product": "vite", "vendor": "vitejs"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "vite-plus", "source": "cna", "vendor": "vitejs"}, "product": "vite-plus", "vendor": "vitejs"}], "created": "2026-10-20T17:00:15.294330+00:00", "updated": "2026-10-20T17:30:13.835756+00:00", "vendors": ["vitejs", "vitejs$PRODUCT$launch-editor", "vitejs$PRODUCT$vite", "vitejs$PRODUCT$vite-plus"]}