https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-22T10:37:05.867805+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-112944 fkie_cve-2026-112944 2026-10-22T10:37:05.892881+00:00

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.

 https://db.gcve.eu/vuln/ghsa-r825-w8mm-5pxw GHSA-r825-w8mm-5pxw — launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors 2026-10-22T10:37:05.893036+00:00

Affected: npm: launch-editor, npm: vite, npm: vite-plus

### Summary

`launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.

### Impact

#### Direct `launch-editor` users

Only apps that match all of the following conditions are affected:

- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory - The user uses or the app specifies any of the following editors: - Vim (including gVim) - MacVim - Emacs (including Emacsclient) - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) - The first argument of `launchEditor` can start with `+` or `-` or the user is using WSL

#### `launch-editor-middleware` users

Only apps that match the following conditions are affected:

- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory - The user uses or the app specifies any of the following editors: - Vim (including gVim) - MacVim - Emacs (including Emacsclient) - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) - launch-editor older than v2.2.0 is used, or the user is using WSL

#### Vite users

Only apps that match the following conditions are affected:

- The attacker is able to create a file system entry (e.g. a file or directory) starting wit…