CVE-2026-112942

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112942
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112942.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112942
Aliases
Downstream
CGA (76)
CLSA (2)
Published
2026-10-20T14:48:06Z
Modified
2026-10-21T02:55:52Z
Severity
  • 7.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
Details

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-77"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112942.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "8.3.0"
                        },
                        {
                            "fixed":  "8.3.3"
                        },
                        {
                            "introduced":  "8.2.0"
                        },
                        {
                            "fixed":  "8.2.4"
                        },
                        {
                            "introduced":  "8.0.0"
                        },
                        {
                            "fixed":  "8.1.6"
                        },
                        {
                            "introduced":  "7.0.0"
                        },
                        {
                            "fixed":  "7.3.7"
                        },
                        {
                            "fixed":  "6.4.4"
                        },
                        {
                            "fixed":  "1.1.0"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StringRangeExpression"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/vitejs/launch-editor

Affected ranges

Type
GIT
Repo
https://github.com/vitejs/launch-editor
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b5334895a00f8000ef3b6a46f2aa9e1a62eb27b4
Fixed
f13cd835d4b8e860b1d4d080ad8a490cc2463679
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.14.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "f13cd835d4b8e860b1d4d080ad8a490cc2463679"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v2.14.2",
            "range":  [
                {
                    "fixed":  "b5334895a00f8000ef3b6a46f2aa9e1a62eb27b4"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v2.*
v2.0.0
v2.1.0
v2.10.0
v2.11.0
v2.11.1
v2.12.0
v2.13.0
v2.13.1
v2.13.2
v2.14.0
v2.14.1
v2.2.0
v2.2.1
v2.3.0
v2.4.0
v2.5.0
v2.6.0
v2.6.1
v2.7.0
v2.8.0
v2.8.1
v2.8.2
v2.9.0
v2.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112942.json"