REDHAT-BUG-2483853: High severity npm/launch-editor vulnerability

Q: Which deployments are exposed?

The issue affects Windows environments where launch-editor is used and an attacker can supply a filename containing special characters to the launchEditor file argument.

Q: What versions include the fix?

The fix is in launch-editor version 2.9.0. For Vite, the corresponding fixed version is 5.4.9.

Published Jun 1, 2026

Updated

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the launch-editor version 2.9.0, corresponding to vite version 5.4.9.

Affected Software

2 affected components

npm/launch-editor<2.9.0

npm/vite=5.4.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade launch-editor to a version that resolves this vulnerability.
Fixed in 2.9.0
Upgrade
Upgrade vite to a version that resolves this vulnerability.
Fixed in 5.4.9

Event History

Jun 1, 2026

Data Sourced

via Red Hat·10:20 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

The issue affects Windows environments where launch-editor is used and an attacker can supply a filename containing special characters to the launchEditor file argument.

What versions include the fix?

The fix is in launch-editor version 2.9.0. For Vite, the corresponding fixed version is 5.4.9.