You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
chore(deps): update dependency vite to v8.1.6 [security] - #1215
launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed.
Impact
Only apps that match all of the following conditions are affected:
The user uses Windows
An attacker can place a file with the malicious filename containing & or %
Either of
An attacker can inject an environment variable with a malicious value
An attacker can add a NTFS alternate data stream to the file placed
Details
Unlike .sh files, .bat / .cmd files on Windows cannot be called directly using child_process.spawn and requires passing them as an argument of cmd.exe. To do so, launch-editor escapes the arguments passed to cmd.exe. But launch-editor did not escape % which is used for environment variables.
Because launch-editor checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.
If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set &calc.exe to %ENV%) and call launchEditor with something%ENV%.
If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named ~-38%calc.exe), they can call launchEditor with something %CMDCMDLINE:~-38%calc.exe.
If the attacker can create a filename containing the %CD% and the subcommand (e.g. &calc.exe ), they can call launchEditor with ./%CD%
launch-editor checked fs.existsSync(fileName) before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in \\..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename.
Combined with the % escaping issue described in GHSA-698v-4r3x-3vcv, this bypass can lead to OS command injection when an attacker controls the file argument.
Impact
Only apps that runs on Windows is affected.
Details
The earlier advisory assumed that fs.existsSync() required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement.
A crafted value ending in \\..:1:1 is interpreted differently by launch-editor-middleware, launch-editor, and Windows:
launch-editor-middleware calls path.resolve() while the final path component is ..:1:1, so it is not treated as a parent-directory component.
launch-editor treats :1:1 as a line-and-column suffix and removes it, leaving a path ending in \\...
On Windows, fs.existsSync() accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist.
Because the existence check passes, the crafted filename reaches the Windows shell command.
launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.
Impact
Direct launch-editor users
Only apps that match all of the following conditions are affected:
The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory
The user uses or the app specifies any of the following editors:
Vim (including gVim)
MacVim
Emacs (including Emacsclient)
Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
The first argument of launchEditor can start with + or - or the user is using WSL
launch-editor-middleware users
Only apps that match the following conditions are affected:
The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory
The user uses or the app specifies any of the following editors:
Vim (including gVim)
MacVim
Emacs (including Emacsclient)
Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
launch-editor older than v2.2.0 is used, or the user is using WSL
Vite users
Only apps that match the following conditions are affected:
The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory
The user uses or the app specifies any of the following editors:
Vim (including gVim)
MacVim
Emacs (including Emacsclient)
Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
The user is using WSL
Details
launchEditor(file) function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with - (also + for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with + as an Ex command. As a result, an existing relative directory such as:
is not treated as a filename when passed to Vim. Vim executes the embedded Ex command.
The following editor has a potentially destructive operation exposed to the CLI arguments:
Vim (including gVim)
MacVim
Emacs (including Emacsclient)
Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
launch-editor-middleware v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, launch-editor converts the paths to relative paths internally, so those are still affected.
Vite 2.0.0+ uses launch-editor-middleware v2.2.0+ so the WSL users are only affected.
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer TIP This summary will be updated as you push new changes.
Superseded by #1217, which has been merged into staging. The dependency updates proposed here are covered by the merged refresh through matching or newer versions, or removal of the obsolete dependency/toolchain. Closing this stale dependency-update PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
8.1.3→8.1.6launch-editor: escapeCmdArgs() omits % escaping on Windows
CVE-2026-112943 / GHSA-698v-4r3x-3vcv
More information
Details
Summary
launch-editordid not escape%on Windows when passing an argument tocmd. When an environment variable contained a malicious value, it was possible that that content to be executed.Impact
Only apps that match all of the following conditions are affected:
&or%Details
Unlike
.shfiles,.bat/.cmdfiles on Windows cannot be called directly usingchild_process.spawnand requires passing them as an argument ofcmd.exe. To do so, launch-editor escapes the arguments passed tocmd.exe. Butlaunch-editordid not escape%which is used for environment variables.Because
launch-editorchecks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.&calc.exeto%ENV%) and calllaunchEditorwithsomething%ENV%.~-38%calc.exe), they can calllaunchEditorwithsomething %CMDCMDLINE:~-38%calc.exe.%CD%and the subcommand (e.g.&calc.exe), they can calllaunchEditorwith./%CD%Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
launch-editor:
fs.existsSync()existence check can be bypassed on WindowsCVE-2026-112942 / GHSA-587h-7wmj-h5pm
More information
Details
Summary
launch-editorcheckedfs.existsSync(fileName)before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in\\..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename.Combined with the
%escaping issue described in GHSA-698v-4r3x-3vcv, this bypass can lead to OS command injection when an attacker controls the file argument.Impact
Only apps that runs on Windows is affected.
Details
The earlier advisory assumed that
fs.existsSync()required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement.A crafted value ending in
\\..:1:1is interpreted differently bylaunch-editor-middleware,launch-editor, and Windows:launch-editor-middlewarecallspath.resolve()while the final path component is..:1:1, so it is not treated as a parent-directory component.launch-editortreats:1:1as a line-and-column suffix and removes it, leaving a path ending in\\...fs.existsSync()accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
CVE-2026-112944 / GHSA-r825-w8mm-5pxw
More information
Details
Summary
launch-editorforwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.Impact
Direct
launch-editorusersOnly apps that match all of the following conditions are affected:
+or-in the working directorylaunchEditorcan start with+or-or the user is using WSLlaunch-editor-middlewareusersOnly apps that match the following conditions are affected:
+or-in the working directoryVite users
Only apps that match the following conditions are affected:
+or-in the working directoryDetails
launchEditor(file)function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with-(also+for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with+as an Ex command. As a result, an existing relative directory such as:is not treated as a filename when passed to Vim. Vim executes the embedded Ex command.
The following editor has a potentially destructive operation exposed to the CLI arguments:
launch-editor-middlewarev2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL,launch-editorconverts the paths to relative paths internally, so those are still affected.Vite 2.0.0+ uses
launch-editor-middlewarev2.2.0+ so the WSL users are only affected.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
vitejs/vite (vite)
v8.1.6Compare Source
Please refer to CHANGELOG.md for details.
v8.1.5Compare Source
Features
inputtoserver.fs.allow(#23035) (95a3cda)inputoption (#22642) (9beae37)Bug Fixes
Object.prototypeis frozen (#23073) (599c5b0)Performance Improvements
Documentation
@experimentalfromresolve.tsconfigPathsJSDoc (#23006) (961643a)Miscellaneous Chores
Tests
Beta Changelogs
8.2.0-beta.0 (2026-07-22)
See 8.2.0-beta.0 changelog
v8.1.4Compare Source
Features
Bug Fixes
import.meta.urlin preload function as-is (#22839) (f1f90ed)Documentation
@defaultforserver.cors(#22859) (70435b2)Miscellaneous Chores
Code Refactoring
Tests
Build System
onwarnwithonLog(#22741) (c581b55)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.