Vite (<= 6.4.3, 7.0.0-7.3.6, 8.0.0-8.1.5, 8.2.0-8.2.3, 8.3.0-8.3.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/vite--6.4.3-7.0.0-7.3.6-8.0.0-8.1.5-8.2.0-8.2.3-8.3.0-8.3.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 20 Oct 2026 23:55:54 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svglaunch-editor: Windows existence check bypass leading to command injection (CVE-2026-112942)https://feed.craftedsignal.io/briefs/2026-10-launch-editor-bypass/Tue, 20 Oct 2026 23:55:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-launch-editor-bypass/An existence check bypass in launch-editor on Windows allows attackers to execute arbitrary commands by supplying crafted file paths ending in ..:line:column.The launch-editor package, which is a dependency for Vite and related tools, contains a high-severity vulnerability identified as CVE-2026-112942. The vulnerability allows an attacker to bypass the fs.existsSync() check on Windows by appending a crafted suffix, ..:line:column, to a file path. Under normal conditions, launch-editor validates that a target file exists before attempting to open it in an IDE or editor. However, the path manipulation vulnerability results in the validation logic incorrectly evaluating the path as a valid directory, allowing the subsequent execution of an editor command with attacker-controlled arguments.

When combined with secondary vulnerabilities involving improper character escaping (noted in GHSA-698v-4r3x-3vcv), this bypass facilitates OS command injection. This issue affects various versions of vite, vite-plus, and the standalone launch-editor package. Developers and security teams should prioritize patching these dependencies to prevent potential remote code execution in development environments.

Attack Chain

  1. An attacker identifies a web application or development environment utilizing a vulnerable version of launch-editor on a Windows host.
  2. The attacker crafts a malicious request parameter containing a file path string ending in \\..:1:1 or a similar variant.
  3. The launch-editor-middleware processes the input and calls path.resolve(), treating the path as legitimate due to the suffix structure.
  4. The launch-editor component strips the line and column suffixes, leaving a trailing \\.. path segment.
  5. The Windows fs.existsSync() function validates the path as existing, successfully passing the internal security check.
  6. The launch-editor component proceeds to construct a system shell command including the user-controlled filename.
  7. The system shell executes the command, resulting in OS command injection if malicious characters were successfully passed through the process invocation.

Impact

The vulnerability poses a significant risk to developers and systems running affected Vite-based applications on Windows. Successful exploitation results in arbitrary OS command execution, potentially leading to unauthorized data access, environment compromise, or further lateral movement within a network. Numerous versions across the vite ecosystem are affected, including major releases from 6.x through 8.x.

Recommendation

  • Update vite to a non-vulnerable version (versions > 8.3.2, 8.2.3, 8.1.5, 7.3.6, or 6.4.3).
  • Update launch-editor to versions > 2.14.1.
  • Update vite-plus to versions > 1.0.0.
  • Audit logs for suspicious file system paths ending in ..:* or similar patterns being passed to developer tooling processes.
  • Monitor for unexpected child processes spawned by Node.js or development server processes.
]]>highadvisoryvulnerabilitycommand-injectiondevelopment-tools