high · 7.5 Patched

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

CVE-2026-112942 · GHSA-587h-7wmj-h5pm · published 20 Oct 2026

How serious is it

Severity: high, CVSS score 7.5 out of 10.
No exploit prediction (EPSS) score yet.
Not on the CISA list of exploited vulnerabilities.
No public exploit in Exploit-DB.

Is your app affected by CVE-2026-112942?

Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.

Who is affected

launch-editor (npm) <= 2.14.1
vite (npm) >= 8.3.0, <= 8.3.2
vite (npm) >= 8.2.0, <= 8.2.3
vite (npm) >= 8.0.0, <= 8.1.5
vite (npm) >= 7.0.0, <= 7.3.6
vite (npm) <= 6.4.3
vite-plus (npm) <= 1.0.0

How to check

Run npm ls launch-editor in your project to see the installed version, including copies pulled in by other packages.
Run npm ls vite in your project to see the installed version, including copies pulled in by other packages.
Run npm ls vite-plus in your project to see the installed version, including copies pulled in by other packages.
Or paste your lockfile into the checker: it lists every package with a known vulnerability, this one included.
Or run npx shippable-dev scan localhost:3000 in your project folder. It reads your lockfile and flags this vulnerability along with every other known one.

How to fix

Copies a prompt for Claude Code, Cursor or Codex: it checks your lockfiles for this and upgrades it.

On <= 2.14.1: Upgrade launch-editor to 2.14.2 or later, commit the lockfile and redeploy.
On >= 8.3.0, <= 8.3.2: Upgrade vite to 8.3.3 or later, commit the lockfile and redeploy.
On >= 8.2.0, <= 8.2.3: Upgrade vite to 8.2.4 or later, commit the lockfile and redeploy.
On >= 8.0.0, <= 8.1.5: Upgrade vite to 8.1.6 or later, commit the lockfile and redeploy.
On >= 7.0.0, <= 7.3.6: Upgrade vite to 7.3.7 or later, commit the lockfile and redeploy.
On <= 6.4.3: Upgrade vite to 6.4.4 or later, commit the lockfile and redeploy.
On <= 1.0.0: Upgrade vite-plus to 1.1.0 or later, commit the lockfile and redeploy.
If a vulnerable version was live, check your logs and rotate the secrets that server could read.

The advisory

### Summary `launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in `\\..:line:column`. This removes the requirement that the attacker be able to place a file with a malicious filename. Combined with the `%` escaping issue described in [GHSA-698v-4r3x-3vcv](https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv), this bypass can lead to OS command injection when an attacker controls the file argument. ### Impact Only apps that runs on Windows is affected. ### Details The earlier advisory assumed that `fs.existsSync()` required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement. A crafted value ending in `\\..:1:1` is interpreted differently by `launch-editor-middleware`, `launch-editor`, and Windows: 1. `launch-editor-middleware` calls `path.resolve()` while the final path component is `..:1:1`, so it is not treated as a parent-directory component. 2. `launch-editor` treats `:1:1` as a line-and-column suffix and removes it, leaving a path ending in `\\..`. 3. On Windows, `fs.existsSync()` accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist. 4. Because the existence check passes, the crafted filename reaches the Windows shell command.

Check your whole app

Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.

References

Merged from GitHub Advisory Database. Last updated 23 Oct 2026. All vulnerabilities · RSS · JSON

Get alerts for new exploited vulnerabilities