launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

Summary

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.

Timeline

1. Oct 20, 2026, 2:57 PM UTCCVE published
2. Oct 20, 2026, 3:22 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 20, 2026, 3:23 PM UTCRecord last updated
4. Oct 22, 2026, 9:34 PM UTCFirst seen by cve.now

Affected versions

• vitejs launch-editor

  fixed in 2.14.2

• vitejs vite

  From 8.3.0 · fixed in 8.3.3; From 8.2.0 · fixed in 8.2.4; From 8.0.0 · fixed in 8.1.6; From 7.0.0 · fixed in 7.3.7; fixed in 6.4.4

• vitejs vite-plus

  fixed in 1.1.0

• launch-editornpm

  fixed in 2.14.2

• vitenpm

  From 8.3.0 · fixed in 8.3.3

• vitenpm

  From 8.2.0 · fixed in 8.2.4

• vitenpm

  From 8.0.0 · fixed in 8.1.6

• vitenpm

  From 7.0.0 · fixed in 7.3.7

• vitenpm

  fixed in 6.4.4

• vite-plusnpm

  fixed in 1.1.0

References 4