{"id":"ghsa-ghsa-r825-w8mm-5pxw","seq":2398,"kind":"advisory","title":"launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors","url":"https://github.com/advisories/GHSA-r825-w8mm-5pxw","permalink":"https://vulnpulse.app/items/ghsa-ghsa-r825-w8mm-5pxw","summary":"影響: npm:launch-editor <= 2.14.1 → 2.14.2, npm:vite >= 8.3.0, <= 8.3.2 → 8.3.3, npm:vite >= 8.2.0, <= 8.2.3 → 8.2.4, npm:vite >= 8.0.0, <= 8.1.5 → 8.1.6, npm:vite >= 7.0.0, <= 7.3.6 → 7.3.7, npm:vite <= 6.4.3 → 6.4.4, npm:vite-plus <= 1.0.0 → 1.1.0\nSummary launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution. Impact Direct launch-editor users Only apps that match all of the following conditions are affected: - The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory - The user uses or the app specifies a…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-112944"],"tags":["GHSA-r825-w8mm-5pxw","launch-editor","vite","vite","vite","vite","vite","vite-plus"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T19:51:52.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}