CVE-2026-112944

About vulnerability

Summary

launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.

Impact

Direct launch-editor users

Only apps that match all of the following conditions are affected:

• The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory
• The user uses or the app specifies any of the following editors:
• Vim (including gVim)
• MacVim
• Emacs (including Emacsclient)
• Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
• The first argument of launchEditor can start with + or - or the user is using WSL

launch-editor-middleware users

Only apps that match the following conditions are affected:

• The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory
• The user uses or the app specifies any of the following editors:
• Vim (including gVim)
• MacVim
• Emacs (including Emacsclient)
• Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
• launch-editor older than v2.2.0 is used, or the user is using WSL

Vite users

Only apps that match the following conditions are affected:

• The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory
• The user uses or the app specifies any of the following editors:
• Vim (including gVim)
• MacVim
• Emacs (including Emacsclient)
• Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
• The user is using WSL

Details

launchEditor(file) function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with - (also + for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with + as an Ex command. As a result, an existing relative directory such as:

+call writefile(["SAFE_MARKER"],"LAUNCH_EDITOR_MARKER")|qa!

is not treated as a filename when passed to Vim. Vim executes the embedded Ex command.

The following editor has a potentially destructive operation exposed to the CLI arguments:

• Vim (including gVim)
• MacVim
• Emacs (including Emacsclient)
• Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)

launch-editor-middleware v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, launch-editor converts the paths to relative paths internally, so those are still affected.

Vite 2.0.0+ uses launch-editor-middleware v2.2.0+ so the WSL users are only affected.

Affected product:

@vinxi/devtools , AngularJS , Next.js , React , TanStack/router , Vue , allure-js , analogjs-astro-angular , analogjs-platform , analogjs-storybook-angular , analogjs-vite-plugin-angular , analogjs-vite-plugin-nitro , analogjs-vitest-angular , angular-build , angular-devkit-build-angular , angular-devkit-build-webpack , antfu-design , appkit , arcjet-js , assistant-ui-vite , astro , astro-expressive-code , astrojs-cloudflare , astrojs-markdoc , astrojs-markdown-remark , astrojs-mdx , astrojs-netlify , astrojs-node , astrojs-preact , astrojs-react , astrojs-solid-js , astrojs-starlight , astrojs-svelte , astrojs-tailwind , astrojs-vercel , astrojs-vue , async-storage , b4a , babel-plugin-remove-graphql-queries , babel-preset-expo , bare-fs , bare-stream , better-auth , better-auth-test-utils , blake2b , blake2b-wasm , blockchain-link-utils , browsers , builder.io-qwik-city , bundle-stats , callstack-repack , callstack-repack-plugin-expo-modules , callstack-repack-plugin-nativewind , callstack-repack-plugin-reanimated , changesets , chat-adapter-tests , chromatic-e2e , clerk-astro , client , cloudflare-vitest-plugin , coin-modules , create-react-app , create-sanity , cypress , devframe , devframes-hub , devframes-plugin-assets , devframes-plugin-code-server , devframes-plugin-data-inspector , devframes-plugin-messages , devframes-plugin-og , devframes-plugin-terminals , devframes-vite , devtools , docsearch , docusaurus , docusaurus-core , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-css-cascade-layers , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-plugin-svgr , docusaurus-preset-classic , docusaurus-search-local , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-mermaid , docusaurus-theme-search-algolia , dxup-nuxt , effect-doctest , effect-vitest , elements , embroider-vite , expect-webdriverio , expo , expo-asset , expo-cli , expo-constants , expo-dev-tools , expo-file-system , expo-font , expo-glass-effect , expo-keep-awake , expo-linking , expo-localization , expo-metro-config , expo-modules-core , expo-modules-jsi , expo-router , expo-router-server , expo-symbols , expo-webpack-config , expo-widgets , forge , fumadocs , fumadocs-ai-chat , fumadocs-graphql , fumadocs-sanity , fumadocs-ui , fumapress , fumapress-ai , fumapress-feedback , fumapress-graphql , fumapress-mintlify , gatsby , gatsby-plugin-page-creator , gatsby-sharp , get-it , graphql-codegen-testing , hiero-sdk-js , imagetools , import , impound , inertiajs-vite , inspect , joshwooding-vite-plugin-react-docgen-typescript , kit , launch-editor , leafygreen-ui , ledger-cosmos-js , ledgerhq-crypto-icons-ui , ledgerhq-live-cli , ledgerhq-live-common , lg-tools-storybook-addon , lg-tools-storybook-decorators , lingui-vite-plugin , livestore , livestore-adapter-cloudflare , livestore-adapter-web , livestore-common , livestore-common-cf , livestore-framework-toolkit , livestore-livestore , livestore-react , livestore-sqlite-wasm , livestore-sync-cf , livestore-sync-electric , livestore-utils , livestore-utils-dev , livestore-webmesh , logs-sdk , logtape-testing-vitest , lucide-astro , lynx-js-config-rsbuild-plugin , lynx-js-qrcode-rsbuild-plugin , lynx-js-rspeedy , masked-view , mastra-server-adapters-test-suite , metamask-core , module-federation/vite , my-bad , netlify-vite-plugin , netlify-vite-plugin-tanstack-start , nitro , node-archiver , nostics , nuxt , nuxt-cli , nuxt-devtools , nuxt-devtools-kit , nuxt-devtools-ui-kit , nuxt-kit , nuxt-nitro-server , nuxt-rspack-builder , nuxt-test-utils , nuxt-vite-builder , nuxt-vite-server , nuxt-webpack-builder , nuxt/test-utils , nx , nx-angular-rspack , nx-angular-rspack-compiler , nx-detox , nx-expo , nx-module-federation , nx-next , nx-react , nx-react-native , nx-vite , nx-vitest , nx-vue , nx-web , octane , octanejs-app-core , octanejs-astro , octanejs-docusaurus , octanejs-email , octanejs-email-cli , octanejs-livestore , octanejs-vite-plugin , orama-orama , oxc , oxc-unshadowed-visitor , oxfmt , oxlint , oxlint-config-inspector , panda , pandacss-transformer , pandacss-vite , pigment-css , pkg-utils , playwright , playwright-experimental-ct-core , playwright-experimental-ct-react , powersync-js , powersync-nuxt , preact-preset-vite , prefresh , puppeteer-core , qwik , racejar , remix , reown-appkit , reown-appkit-controllers , reown-appkit-scaffold-ui , reown-appkit-ui , reown-appkit-utils , repack , ripple , rock , rock-js-platform-android , rock-js-platform-apple-helpers , rock-js-platform-ios , rock-js-plugin-brownfield-android , rock-js-plugin-brownfield-ios , rock-js-plugin-metro , rock-js-plugin-repack , rollup-plugin-stats , rollup-plugin-webpack-stats , rsdoctor , rsdoctor-core , rsdoctor-rspack-plugin , rsdoctor-sdk , rsdoctor-webpack-plugin , rspack-cli , rspack-dev-server , runtime-cli , rushstack-heft-rspack-plugin , rushstack-heft-vscode-extension-rig , rushstack-heft-web-rig , rushstack-heft-webpack5-plugin , sanity , sanity-blueprints , sanity-cli , sanity-cli-build , sanity-cli-test , sanity-codegen , sanity-io/cli , sanity-migrate , sanity-plugin-mux-input , sanity-preview-url-secret , sanity-svelte-loader , sanity-tsdown-config , sanity-vanilla-extract-vite-plugin , sanity-vercel-protection-bypass , sanity-vision , sanity-workbench-cli , scalar-astro , scalar-starlight , scalar-sveltekit , sentry-astro , sentry-cloudflare , sentry-nitro , sentry-nuxt , sentry-solidstart , sentry-sveltekit , sharp , solid-vite-plugin , solidjs-start , storybook , storybook-addon-a11y , storybook-angular , storybook-angular-vite , storybook-builder-vite , storybook-builder-webpack5 , storybook-core-webpack , storybook-csf-plugin , storybook-experimental-nextjs-vite , storybook-html , storybook-html-vite , storybook-nextjs-vite , storybook-preact , storybook-preact-vite , storybook-preset-create-react-app , storybook-react , storybook-react-dom-shim , storybook-react-native-web-vite , storybook-react-vite , storybook-svelte , storybook-svelte-vite , storybook-sveltekit , storybook-tanstack-react , storybook-vue3 , storybook-vue3-vite , storybook-web-components , storybook-web-components-vite , strapi-plugin-cloud , strapi-plugin-color-picker , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-strapi , streamx , stryker-mutator-vitest-runner , styled-components , sveltejs-adapter-bun , sveltejs-adapter-node , sveltejs-adapter-static , sveltejs-adapter-vercel , sveltejs-kit , sveltejs-vite-plugin-svelte-inspector , tabler-icons-astro , tailwindcss-vite , tanstack-devtools , tanstack-devtools-vite , tanstack-directive-functions-plugin , tanstack-react-start , tanstack-react-start-rsc , tanstack-router-plugin , tanstack-start-plugin-core , tanstack-table , tar-fs , tar-stream , teex , telemetry , test-utils , text-decoder , trezor-connect-web , trezor-env-utils , trezor-suite , tsrx-vite-plugin-hono , tsrx-vite-plugin-preact , tsrx-vite-plugin-react , tsrx-vite-plugin-solid , tsrx-vite-plugin-vue , tsrx-vue , unctx , unhead , unhead-bundler , unhead-vue , unimport , unocss , unocss-astro , unocss-inspector , unocss-nuxt , unocss-vite , unocss-webpack , unplugin , unplugin-combine , unplugin-vue , vanilla-extract , vercel , vercel-react-router , vercel-remix-builder , vinxi , vinxi-router , vinxi-server-components , vinxi-server-functions , visual-editing , vite , vite-dev-rpc , vite-hot-client , vite-node , vite-plugin-babel , vite-plugin-basic-ssl , vite-plugin-checker , vite-plugin-css-injected-by-js , vite-plugin-inspect , vite-plugin-istanbul , vite-plugin-react , vite-plugin-rnw , vite-plugin-ruby , vite-plugin-satteri , vite-plugin-singlefile , vite-plugin-solid , vite-plugin-storybook-nextjs , vite-plugin-svelte , vite-plugin-tanstack-start-zephyr , vite-plugin-top-level-await , vite-plugin-vinext-zephyr , vite-plugin-vue , vite-plugin-vue-inspector , vite-plugin-vue-tracer , vite-plugin-vuetify , vite-plugin-zephyr , vite-plus , vite-prerender-plugin , vite-tsconfig-paths , vitefu , vitejs-devtools , vitejs-devtools-kit , vitejs-devtools-vitest , vitejs-plugin-react , vitejs-plugin-react-swc , vitepress , vitest , vitest-axe , vitest-browser , vitest-browser-playwright , vitest-browser-preview , vitest-coverage-istanbul , vitest-coverage-v8 , vitest-mocker , vitest-ui , vitest-web-worker , vitest-webdriverio , voidzero-dev-vite-plus-test , waku , wallet-adapter , walletconnect-core , walletconnect-sign-client , walletconnect-solana-adapter , walletconnect-types , walletconnect-universal-provider , walletconnect-utils , walletconnect-utils-scoped , wdio-browser-runner , wdio-config , wdio-devtools-script , wdio-globals , wdio-local-runner , wdio-runner , wdio-utils , web3auth-web , webdriver , webdriverio , webpack-dev-server , wordpress-scripts , workers-sdk , workflow-vitest , workflow-world-testing , workflows , wyw-in-js-vite , xdl , zbsearch-plugin-docusaurus , zbsearch-plugin-starlight , zbsearch-plugin-vitepress , zephyr-astro-integration , zephyr-nuxt-module

Affected packages:

@vitejs/plugin-legacy @ 4.5.5 (+3823 more)