| Package | Affected versions | Patched versions |
|---|---|---|
| launch-editor | < 2.14.2 | 2.14.2 |
| vite | ≥ 7.0.0, < 7.3.7≥ 8.0.0, < 8.1.6≥ 8.2.0, < 8.2.4≥ 8.3.0, < 8.3.3< 6.4.4 | 7.3.78.1.68.2.48.3.36.4.4 |
| vite-plus | < 1.1.0 | 1.1.0 |
launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.
launch-editor usersOnly apps that match all of the following conditions are affected:
+ or - in the working directorylaunchEditor can start with + or - or the user is using WSLlaunch-editor-middleware usersOnly apps that match the following conditions are affected:
+ or - in the working directoryOnly apps that match the following conditions are affected:
+ or - in the working directorylaunchEditor(file) function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with - (also + for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with as an Ex command. As a result, an existing relative directory such as:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free++call writefile(["SAFE_MARKER"],"LAUNCH_EDITOR_MARKER")|qa!
is not treated as a filename when passed to Vim. Vim executes the embedded Ex command.
The following editor has a potentially destructive operation exposed to the CLI arguments:
launch-editor-middleware v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, launch-editor converts the paths to relative paths internally, so those are still affected.
Vite 2.0.0+ uses launch-editor-middleware v2.2.0+ so the WSL users are only affected.