launch-editor CVE-2026-112942

Exploitation is limited to Windows hosts only - the vulnerable code path is gated on process.platform === 'win32'. An attacker must supply an attacker-controlled file argument to launch-editor-middleware (e.g. via the dev server's open-in-editor endpoint), and that argument must end in a parent-directory component ('..') followed by a line-and-column suffix (:line:col) so the path resolves to an existing parent directory and the suffix is stripped before the existsSync check, bypassing filename-existence validation without the malicious filename existing. Crucially, this bypass alone does NOT yield code execution: it must be combined with the separately described Windows percent-expansion flaw to achieve OS command injection. Limiting factors: Windows-only platform, requirement for active user interaction (UI:A), a reachable launch-editor-middleware endpoint (typically a local/dev-time Vite server), the presence of the companion percent-expansion vulnerability, and affected versions prior to 2.14.2.

This is a genuine but conditional supply-chain risk rather than a drop-everything emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:A) scores 7.5 HIGH and indicates network reachability with no privileges, but it carries two important dampeners the headline score obscures: AT:P (a specific attack requirement must be present) and UI:A (active user interaction). The description further narrows this to Windows-only (process.platform === 'win32') and, critically, states the existsSync bypass only 'can lead to OS command injection when combined with the separately described Windows percent-expansion flaw' - i.e. this CVE alone is a validation-bypass primitive, not a standalone RCE. No EPSS score was provided, this CVE is NOT in CISA KEV (no confirmed active exploitation), and no public exploit was supplied - the only code evidence is the vendor fix commit, which is a patch, not a weaponized POC. The CWE-77 (command injection) classification and the network vector could make this look like a wormable remote bug, but the real-world picture is a developer-tooling defect requiring Windows, a reachable launch-editor-middleware endpoint, user interaction, and chaining with a second flaw. Net: patch promptly (especially Vite/Vite Plus dev environments on Windows), but treat it as a chained, condition-gated issue rather than a widespread auto-exploitable one.

On a Windows developer machine running a Vite dev server, an attacker who can reach the launch-editor-middleware open-in-editor endpoint supplies a crafted file argument ending in a parent-directory component plus a line:column suffix, which passes the filename-existence check even though the malicious filename does not exist. Combined with the separate Windows percent-expansion flaw, this permits OS command injection (CWE-77) executing in the context of the developer process. No public exploit code was provided - only the vendor patch commit (f13cd83) is available.