{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/vite--6.4.3-7.0.0-7.3.6-8.0.0-8.1.5-8.2.0-8.2.3-8.3.0-8.3.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"id":"CVE-2026-112942"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["launch-editor (\u003c= 2.14.1)","vite (\u003c= 6.4.3, 7.0.0-7.3.6, 8.0.0-8.1.5, 8.2.0-8.2.3, 8.3.0-8.3.2)","vite-plus (\u003c= 1.0.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","command-injection","development-tools"],"_cs_type":"advisory","_cs_vendors":["Vite","launch-editor"],"content_html":"\u003cp\u003eThe \u003ccode\u003elaunch-editor\u003c/code\u003e package, which is a dependency for Vite and related tools, contains a high-severity vulnerability identified as CVE-2026-112942. The vulnerability allows an attacker to bypass the \u003ccode\u003efs.existsSync()\u003c/code\u003e check on Windows by appending a crafted suffix, \u003ccode\u003e..:line:column\u003c/code\u003e, to a file path. Under normal conditions, \u003ccode\u003elaunch-editor\u003c/code\u003e validates that a target file exists before attempting to open it in an IDE or editor. However, the path manipulation vulnerability results in the validation logic incorrectly evaluating the path as a valid directory, allowing the subsequent execution of an editor command with attacker-controlled arguments.\u003c/p\u003e\n\u003cp\u003eWhen combined with secondary vulnerabilities involving improper character escaping (noted in GHSA-698v-4r3x-3vcv), this bypass facilitates OS command injection. This issue affects various versions of \u003ccode\u003evite\u003c/code\u003e, \u003ccode\u003evite-plus\u003c/code\u003e, and the standalone \u003ccode\u003elaunch-editor\u003c/code\u003e package. Developers and security teams should prioritize patching these dependencies to prevent potential remote code execution in development environments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a web application or development environment utilizing a vulnerable version of \u003ccode\u003elaunch-editor\u003c/code\u003e on a Windows host.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious request parameter containing a file path string ending in \u003ccode\u003e\\\\..:1:1\u003c/code\u003e or a similar variant.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003elaunch-editor-middleware\u003c/code\u003e processes the input and calls \u003ccode\u003epath.resolve()\u003c/code\u003e, treating the path as legitimate due to the suffix structure.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003elaunch-editor\u003c/code\u003e component strips the line and column suffixes, leaving a trailing \u003ccode\u003e\\\\..\u003c/code\u003e path segment.\u003c/li\u003e\n\u003cli\u003eThe Windows \u003ccode\u003efs.existsSync()\u003c/code\u003e function validates the path as existing, successfully passing the internal security check.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003elaunch-editor\u003c/code\u003e component proceeds to construct a system shell command including the user-controlled filename.\u003c/li\u003e\n\u003cli\u003eThe system shell executes the command, resulting in OS command injection if malicious characters were successfully passed through the process invocation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a significant risk to developers and systems running affected Vite-based applications on Windows. Successful exploitation results in arbitrary OS command execution, potentially leading to unauthorized data access, environment compromise, or further lateral movement within a network. Numerous versions across the \u003ccode\u003evite\u003c/code\u003e ecosystem are affected, including major releases from 6.x through 8.x.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003evite\u003c/code\u003e to a non-vulnerable version (versions \u0026gt; 8.3.2, 8.2.3, 8.1.5, 7.3.6, or 6.4.3).\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003elaunch-editor\u003c/code\u003e to versions \u0026gt; 2.14.1.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003evite-plus\u003c/code\u003e to versions \u0026gt; 1.0.0.\u003c/li\u003e\n\u003cli\u003eAudit logs for suspicious file system paths ending in \u003ccode\u003e..:*\u003c/code\u003e or similar patterns being passed to developer tooling processes.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected child processes spawned by Node.js or development server processes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T23:55:54Z","date_published":"2026-10-20T23:55:54Z","id":"https://feed.craftedsignal.io/briefs/2026-10-launch-editor-bypass/","summary":"An existence check bypass in launch-editor on Windows allows attackers to execute arbitrary commands by supplying crafted file paths ending in ..:line:column.","title":"launch-editor: Windows existence check bypass leading to command injection (CVE-2026-112942)","url":"https://feed.craftedsignal.io/briefs/2026-10-launch-editor-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Vite (\u003c= 6.4.3, 7.0.0-7.3.6, 8.0.0-8.1.5, 8.2.0-8.2.3, 8.3.0-8.3.2)","version":"https://jsonfeed.org/version/1.1"}