CVE-2026-112942: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

October 20, 2026

launch-editor checked fs.existsSync(fileName) before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in \\..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename.

References

github.com/advisories/GHSA-587h-7wmj-h5pm
github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679
github.com/vitejs/launch-editor/releases/tag/v2.14.2
github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm
nvd.nist.gov/vuln/detail/CVE-2026-112942

Code Behaviors & Features

Detect and mitigate CVE-2026-112942 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →