https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 07:02:19 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-112944 <p>launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.</p> <p>launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.</p> https://db.gcve.eu/vuln/fkie_cve-2026-112944 https://db.gcve.eu/vuln/ghsa-r825-w8mm-5pxw <p><strong>Affected:</strong> npm: launch-editor, npm: vite, npm: vite-plus</p> <p>### Summary</p> <p>`launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.</p> <p>### Impact</p> <p>#### Direct `launch-editor` users</p> <p>Only apps that match all of the following conditions are affected:</p> <p>- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory - The user uses or the app specifies any of the following editors: - Vim (including gVim) - MacVim - Emacs (including Emacsclient) - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) - The first argument of `launchEditor` can start with `+` or `-` or the user is using WSL</p> <p>#### `launch-editor-middleware` users</p> <p>Only apps that match the following conditions are affected:</p> <p>- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory - The user uses or the app specifies any of the following editors: - Vim (including gVim) - MacVim - Emacs (including Emacsclient) - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) - launch-editor older than v2.2.0 is used, or the user is using WSL</p> <p>#### Vite users</p> <p>Only apps that match the following conditions are affected:</p> <p>- The attacker is able to create a file system entry (e.g. a file or directory) starting wit…</p> <p><strong>Affected:</strong> npm: launch-editor, npm: vite, npm: vite-plus</p> <p>### Summary</p> <p>`launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.</p> <p>### Impact</p> <p>#### Direct `launch-editor` users</p> <p>Only apps that match all of the following conditions are affected:</p> <p>- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory - The user uses or the app specifies any of the following editors: - Vim (including gVim) - MacVim - Emacs (including Emacsclient) - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) - The first argument of `launchEditor` can start with `+` or `-` or the user is using WSL</p> <p>#### `launch-editor-middleware` users</p> <p>Only apps that match the following conditions are affected:</p> <p>- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory - The user uses or the app specifies any of the following editors: - Vim (including gVim) - MacVim - Emacs (including Emacsclient) - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) - launch-editor older than v2.2.0 is used, or the user is using WSL</p> <p>#### Vite users</p> <p>Only apps that match the following conditions are affected:</p> <p>- The attacker is able to create a file system entry (e.g. a file or directory) starting wit…</p> https://db.gcve.eu/vuln/ghsa-r825-w8mm-5pxw