CVE-2026-112944: launch-editor Package Arbitrary Command Execution Vulnerability
Summary
CVE-2026-112944: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors. Affects launch-editor versions < 2.14.2. Fixed in 2.14.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The launch-editor package is a utility that facilitates the opening of files in various text editors directly from the command line. It is commonly used in development environments to streamline the editing process. However, due to its design, it can be vulnerable to command injection attacks when certain editors interpret file paths as command flags.
Vulnerability Detail
The vulnerability in the launch-editor package arises from the way it forwards file paths to text editors without proper sanitization. If a file path begins with a '+' or '-', editors like Vim may interpret these as command flags rather than file names. This can lead to arbitrary command execution, potentially allowing attackers to overwrite files or execute unintended commands. The vulnerability affects users who can create file system entries starting with these characters and use specific editors, particularly in environments like WSL.
How To Fix
Latest published version: 2.14.2 as of 23 Oct 2026
npm install launch-editor@2.14.2The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using file names that start with '+' or '-' when opening files with the launch-editor package. Additionally, consider switching to a different editor that does not interpret these characters as command flags.
Conclusion
The launch-editor package has a significant vulnerability that can lead to arbitrary command execution due to improper handling of file paths. Users are advised to update to the latest version to mitigate this risk. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for launch-editor →
FAQ
The CVSS score of this vulnerability is 6.3, indicating a moderate severity level.
The affected editors include Vim (and its variants like gVim and MacVim), Emacs, and Notepad++ (when using certain plugins).
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you cannot update the package, avoid using file names that start with '+' or '-' as a temporary measure to mitigate the risk.
Yes, Vite versions 8.3.3 and later address this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for launch-editor.
