CVE-2026-112942 vitejs CVE debrief

Who should care

Defenders responsible for Node.js environments, particularly those using launch-editor, should assess exposure and prioritize patching to version 2.14.2 or later. The vulnerability affects operators, platforms, and security teams, and defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-112942 is a high-severity vulnerability in launch-editor that allows an attacker to bypass the `fs.existsSync()` existence check on Windows, potentially leading to OS command injection. Defenders should prioritize patching to version 2.14.2 or later and assess exposure in Node.js environments.

• Potential OS command injection in Node.js environments
• Bypass of filename existence validation
• Increased risk of exploitation in Windows environments

Technical summary

The launch-editor package is vulnerable to a bypass of the `fs.existsSync()` existence check on Windows, allowing an attacker to pass filename existence validation without requiring the malicious filename to exist. This can lead to OS command injection when combined with another flaw. The vulnerability is related to improper validation of file arguments, and the affected product context is Node.js environments. Defenders should prioritize patching launch-editor to version 2.14.2 or later and assess exposure in Node.js environments.

Defensive priority

Defenders should prioritize patching launch-editor to version 2.14.2 or later, and assess exposure in Node.js environments.

Recommended defensive actions

• Patch launch-editor to version 2.14.2 or later
• Assess exposure in Node.js environments
• Verify affected versions and apply fixes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. The launch-editor package is used in Node.js environments, and defenders should verify the presence of affected versions and apply fixes. The evidence limits are based on the provided source corpus, and the known affected scope is related to Windows environments. Defenders should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.