launch-editor EUVD-2026-105039

Windows-only - the flawed code path is in construct-windows-launch-command.js and does not affect Linux or macOS. Exploitation requires that an attacker-controlled value reaches launch-editor as an argument: either an environment variable value or a file path/name that contains a '%' character enabling CMD variable expansion (e.g. the %VAR:old=new% modifier form), which cmd.exe expands before caret escaping. The open-in-editor feature must actually be invoked (e.g. via a Vite dev-server overlay). Limiting factors: non-Windows platforms are unaffected; the attacker must be able to influence the environment or the filename/path that is opened; and no injection occurs for inputs without '%'. This is a development-time feature, so the realistic victim is a developer's workstation rather than a production server.

This is a medium-severity (CVSS 4.0 base 6.3) OS command injection (CWE-78) that is best characterized as a real-but-narrow issue rather than a top priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L) signals network reach with no privileges, but the AT:P flag (Attack Requirements: Present) and the deliberately Low impact ratings reflect that exploitation is contingent on attacker-controlled '%' content and the Windows-only CMD variable-expansion quirk - not a clean drive-by. No EPSS score was provided, so statistical exploitation probability cannot be cited. The vulnerability is NOT in CISA KEV, so exploitation status is 'no public exploit identified at time of analysis'; a vendor security advisory (GHSA-698v-4r3x-3vcv), fixing PR, and patched release exist, but no standalone POC is present in the inputs. No SSVC decision data was supplied. One tension worth flagging: the vector marks AV:N while the mechanism is fundamentally a Windows/CMD-local argument-escaping flaw triggered by the dev-time open-in-editor feature - treat AV:N as generous and verify the delivery path (malicious repo/filename vs. environment variable) against your own exposure. Overall: patch on normal cadence; it is not an emergency absent evidence of active exploitation.

A developer on Windows runs a Vite (or vite-plus) dev server whose click-to-open-in-editor feature is backed by launch-editor < 2.14.2. An attacker who can influence an environment variable value or a file path/name that gets passed to the editor supplies a value containing '%' with a CMD variable-expansion modifier (e.g. %VAR:old=new%); because launch-editor does not escape '%' before invoking cmd.exe, CMD expands/executes the injected content as the developer's user. No public exploit is identified, but the advisory and patch diff fully document the mechanism.