launch-editor CVE-2026-112944

Exploitation requires ALL of: (1) an attacker-controlled filesystem entry whose name begins with '+' or '-' existing in the working directory; (2) the selected editor being one that treats such arguments as flags - Vim, gVim, MacVim, Emacs, Emacsclient, or Notepad++ with a plugin exposing dangerous operations (editors like VS Code/'code' are not listed as affected); and (3) the path remaining relative or being converted to a relative WSL path (e.g., files on a Windows drive under WSL via /mnt/c), which is what keeps Vite and newer middleware callers exposed. Limiting factors: the malicious filename must already be present on disk, the vulnerable editor must be the one actually configured/selected, and VS Code and absolute-path invocations are not vulnerable - these preconditions (reflected as AT:P) substantially narrow real-world exploitability despite the unauthenticated network reachability of a dev server endpoint.

This is an argument/command injection flaw (CWE-88) in launch-editor, the dev-time 'open in editor' helper bundled with Vite and vite-plus. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L) scores 6.3 (Medium), and critically includes AT:P - attack requirements are present, meaning exploitation is NOT unconditional: the attacker must first place a filesystem entry whose name begins with '+' or '-' in the working directory, an affected editor (Vim/gVim, MacVim, Emacs/Emacsclient, or Notepad++ with a dangerous plugin) must be the one selected, and the path must stay relative or be converted to a relative WSL path. No EPSS score, KEV listing, or public POC was supplied in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of PR:N/UI:N with AT:P is the key signal: although technically network-reachable and unauthenticated (via a dev server's open-in-editor endpoint), the precondition chain (malicious filename already on disk + specific editor + relative/WSL path) makes this an opportunistic, environment-dependent issue rather than a mass-exploitable one. Impacts are rated Low across C/I/A despite the description mentioning arbitrary command execution, because execution is constrained to the capabilities of the selected editor and the narrow preconditions. Net: a legitimate supply-chain/dev-tooling hardening priority for Vite users, but not a drop-everything emergency absent exploitation signals.

In a project using Vite's dev server, an attacker gets a file named like '+call system("...")' written into the working directory (e.g., via a repo checkout, dependency, or upload). When the developer or an automatic middleware caller triggers launch-editor with that path and Vim/gVim/Emacs/MacVim/Notepad++ is the configured editor, the leading '+'/'-' name is parsed as an editor command-line flag instead of a filename, causing unintended file overwrite or command execution. No public exploit was provided, but the fix commit and advisory describe the mechanism precisely; WSL path conversion keeps Vite and newer middleware callers exposed.