Launch Editor
Monthly
Path-validation bypass in launch-editor before 2.14.2 on Windows allows unauthenticated remote attackers to pass a crafted file:line:column argument that resolves to an existing parent directory and slips past the library's filename-existence check. The bypass does not by itself execute code; it becomes an OS command injection risk only when chained with the separately described Windows percent-expansion flaw, and exploitation requires user interaction plus a reachable launch-editor-middleware endpoint such as a Vite dev server. No public exploit was identified at time of analysis, and the issue is fixed in 2.14.2.
Argument injection in launch-editor (prior to 2.14.2), the Node.js 'open file in editor' helper shipped with Vite and vite-plus, allows an unauthenticated attacker who can place a file whose name begins with '+' or '-' into the project working directory to have that name interpreted as a command-line flag by the selected editor. When the reachable editor is Vim/gVim, MacVim, Emacs/Emacsclient, or Notepad++ with a plugin exposing dangerous operations, and the path stays relative (or is converted to a relative WSL path), this can lead to unintended file overwrite or arbitrary command execution in the developer's context. Exploitation is heavily preconditioned - the malicious filesystem entry must already exist, a vulnerable editor must be the configured one, and VS Code or absolute-path invocations are unaffected - so per the independent assessment it is rated AC:H with limited (low) confidentiality, integrity, and availability impact rather than a straightforward RCE; no public exploit code has been identified at time of analysis.
OS command injection on Windows in the launch-editor npm package before 2.14.2 lets remote attackers who can influence an environment variable value or a file path containing '%' trigger cmd.exe variable expansion and execute arbitrary commands when the open-in-editor feature is invoked. The flaw is rated medium severity (CVSS 4.0 base 6.3; CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) and is limited to Windows developer workstations using Vite or Vite Plus dev-server tooling; no public exploit identified at time of analysis.
launch-editor allows users to open files with line numbers in editor from Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Path-validation bypass in launch-editor before 2.14.2 on Windows allows unauthenticated remote attackers to pass a crafted file:line:column argument that resolves to an existing parent directory and slips past the library's filename-existence check. The bypass does not by itself execute code; it becomes an OS command injection risk only when chained with the separately described Windows percent-expansion flaw, and exploitation requires user interaction plus a reachable launch-editor-middleware endpoint such as a Vite dev server. No public exploit was identified at time of analysis, and the issue is fixed in 2.14.2.
Argument injection in launch-editor (prior to 2.14.2), the Node.js 'open file in editor' helper shipped with Vite and vite-plus, allows an unauthenticated attacker who can place a file whose name begins with '+' or '-' into the project working directory to have that name interpreted as a command-line flag by the selected editor. When the reachable editor is Vim/gVim, MacVim, Emacs/Emacsclient, or Notepad++ with a plugin exposing dangerous operations, and the path stays relative (or is converted to a relative WSL path), this can lead to unintended file overwrite or arbitrary command execution in the developer's context. Exploitation is heavily preconditioned - the malicious filesystem entry must already exist, a vulnerable editor must be the configured one, and VS Code or absolute-path invocations are unaffected - so per the independent assessment it is rated AC:H with limited (low) confidentiality, integrity, and availability impact rather than a straightforward RCE; no public exploit code has been identified at time of analysis.
OS command injection on Windows in the launch-editor npm package before 2.14.2 lets remote attackers who can influence an environment variable value or a file path containing '%' trigger cmd.exe variable expansion and execute arbitrary commands when the open-in-editor feature is invoked. The flaw is rated medium severity (CVSS 4.0 base 6.3; CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) and is limited to Windows developer workstations using Vite or Vite Plus dev-server tooling; no public exploit identified at time of analysis.
launch-editor allows users to open files with line numbers in editor from Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.