npm launch-editor and Vite Command Injection on Windows via Path Suffix Bypass
Attackers can bypass file existence checks in npm packages to inject OS commands on Windows systems using crafted path suffixes.
Key points
- npm launch-editor versions up to 2.14.1 are vulnerable to command injection.
- Multiple Vite version ranges require updates to patched releases.
- The flaw allows bypassing file existence checks on Windows.
Security researchers identified a high-severity command injection flaw in npm packages commonly used in web development workflows. The vulnerability affects `launch-editor` and several versions of `vite`, allowing attackers to execute arbitrary operating system commands. This issue specifically impacts applications running on Windows environments, where path handling differs from other operating systems.
Root cause
The vulnerability stems from how `launch-editor` validates file paths before passing them to an external editor command. The package previously relied on `fs.existsSync()` to ensure a file existed, assuming this would prevent malicious input. However, attackers can bypass this check on Windows by crafting a path ending in `\\..:line:column`. This specific string manipulation tricks the system into validating a parent directory instead of the non-existent file.
Attack path
The exploit chain leverages differences in how the middleware, the library, and the Windows OS interpret path components. First, `launch-editor-middleware` resolves the path without treating the final component as a parent directory. Next, `launch-editor` strips the line-and-column suffix, leaving a path ending in `\\..`. Windows then accepts this as a valid existing directory, allowing the crafted filename to reach the shell command execution stage.
Affected versions
- npm launch-editor versions <= 2.14.1
- npm vite versions >= 8.3.0, <= 8.3.2
- npm vite versions >= 8.2.0, <= 8.2.3
- npm vite versions >= 8.0.0, <= 8.1.5
- npm vite versions >= 7.0.0, <= 7.3.6
- npm vite versions <= 6.4.3
- npm vite-plus versions <= 1.0.0
Mitigation
- Update npm launch-editor to version 2.14.2 or later.
- Update npm vite to version 8.3.3, 8.2.4, 8.1.6, 7.3.7, or 6.4.4 depending on the major version.
- Update npm vite-plus to version 1.1.0 or later.
Detection notes
Security teams should monitor for unexpected process spawns initiated by node applications on Windows endpoints. Look for editor executables launching with arguments containing double backslashes or unusual line-column suffixes. Check audit logs for file system access attempts that resolve to parent directories rather than specific files. Investigate any shell command executions triggered by development tools that do not align with standard user workflows. Contain affected hosts by isolating them from the network if suspicious activity is confirmed.
What to do and how to stay safe: Vite
- Audit your project dependencies for vulnerable versions of launch-editor and vite.
- Update affected packages to the latest patched versions immediately.
- Monitor Windows hosts for anomalous editor process launches with complex path arguments.
- Review build logs for unexpected command executions during development cycles.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which operating systems are affected by this vulnerability?
Only Windows applications are affected by this specific command injection bypass.
Is there a confirmed fix for this issue?
Yes, patched versions are available for launch-editor, vite, and vite-plus.
What CVE ID is associated with this advisory?
The vulnerability is tracked as CVE-2026-112942.
