Description
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
vitejs launch-editor
< 2.14.2affected
vitejs vite
>= 8.3.0, < 8.3.3affected>= 8.2.0, < 8.2.4affected>= 8.0.0, < 8.1.6affected>= 7.0.0, < 7.3.7affected< 6.4.4affected
vitejs vite-plus
< 1.1.0affected