PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-112943 vitejs CVE debrief

A vulnerability in launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2. The vulnerability allows for potential code execution on Windows due to improper escaping of % characters. Defenders should verify environment variables and update to version 2.14.2 or later.

Vendor
vitejs
Product
launch-editor
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-20
Advisory published
2026-10-20
Advisory updated
2026-10-20

Who should care

Defenders responsible for Node.js environments using launch-editor should assess exposure and prioritize updates. Defenders should verify environment variables and update to version 2.14.2 or later. The vulnerability allows for potential code execution on Windows due to improper escaping of % characters. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed.

Why it matters

CVE-2026-112943 allows for potential code execution on Windows due to improper escaping of % characters in launch-editor. Defenders should verify environment variables, update to version 2.14.2 or later, and monitor for suspicious activity.

  • Verify environment variable security
  • Update launch-editor to prevent potential code execution
  • Monitor for suspicious activity

Technical summary

The launch-editor package did not properly escape % characters on Windows, allowing for potential code execution when a malicious environment variable is present. This vulnerability is fixed in version 2.14.2. Defenders should prioritize verifying environment variables and updating to version 2.14.2 or later. The vulnerability allows for potential code execution on Windows due to improper escaping of % characters. Affected product deployments should be reviewed for exposure and updated to version 2.14.2 or later. The vulnerability was publicly disclosed and fixed in version 2.14.2.

Defensive priority

Defenders should prioritize verifying environment variables and updating to version 2.14.2 or later.

Recommended defensive actions

  • Verify environment variables for malicious values
  • Update launch-editor to version 2.14.2 or later
  • Monitor for suspicious activity
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional verification is needed to confirm affected versions and environments. The launch-editor package did not properly escape % characters on Windows, allowing for potential code execution when a malicious environment variable is present. Defenders should prioritize verifying environment variables and updating to version 2.14.2 or later. The vulnerability was publicly disclosed and fixed in version 2.14.2.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-112943 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-112943

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-112943 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-112943

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • launch-editor: escapeCmdArgs() omits % escaping on Windows

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/112xxx/CVE-2026-112943.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv

    Supplemental source - x_refsource_CONFIRM

  • Source reference

    Unverified legacy reference

    URL: https://github.com/vitejs/launch-editor/pull/155

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://github.com/vitejs/launch-editor/releases/tag/v2.14.2

    Supplemental source - x_refsource_MISC

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.