Details

Summary

launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed.

Impact

Only apps that match all of the following conditions are affected:

• The user uses Windows
• An attacker can place a file with the malicious filename containing & or %
• Either of
  • An attacker can inject an environment variable with a malicious value
  • An attacker can add a NTFS alternate data stream to the file placed

Details

Unlike .sh files, .bat / .cmd files on Windows cannot be called directly using child_process.spawn and requires passing them as an argument of cmd.exe. To do so, launch-editor escapes the arguments passed to cmd.exe. But launch-editor did not escape % which is used for environment variables.

Because launch-editor checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.

• If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set &calc.exe to %ENV%) and call launchEditor with something%ENV%.
• If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named ~-38%calc.exe), they can call launchEditor with something %CMDCMDLINE:~-38%calc.exe.
• If the attacker can create a filename containing the %CD% and the subcommand (e.g. &calc.exe ), they can call launchEditor with ./%CD%

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv
• https://nvd.nist.gov/vuln/detail/CVE-2026-112943
• https://github.com/vitejs/launch-editor/pull/155
• https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc
• https://github.com/vitejs/launch-editor/releases/tag/v2.14.2
• https://github.com/advisories/GHSA-698v-4r3x-3vcv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

v8.2.4

Compare Source

Please refer to CHANGELOG.md for details.

v8.2.2

Compare Source

Features

• build: avoid settling seen preload dependencies for performance (#​23446) (e6f6b3e)
• devtools: enable dev server integration (#​23333) (68aeb8a)
• accept Rolldown watch options in server.watch (#​23133) (1b5cfe3)
• add closeServer and closePreviewServer hooks (#​23110) (e17d2d5)
• add top-level tsconfig option (#​23310) (93164c3)
• add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#​23191) (fdef04f)
• cli: support naming the CPU profile via --profile [name] (#​23042) (a500dee)
• config: warn on named imports from JSON modules (#​23378) (472385e)
• css: minify style tag (#​23183) (8156684)
• searched params attached to workers are now preserved (#​22280) (517b97f)
• support subpath imports in dynamic import statements (#​23185) (b78e2f1)
• use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#​22888) (4366ac4)
• use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#​22894) (e38f29e)
• worker: remove worker chunk if it's detected that it's not referenced (#​22473) (924997a)

Bug Fixes

• handle CRLF line endings in code frame positions (#​23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #​17467) (#​23437) (ef0dc17)
• build: keep hash placeholders as-is in resolveFileUrl hook (#​23422) (e8d6a4d)
• bundled-dev: mark payload delivered on client report (#​23373) (a6d43bc)
• deps: update all non-major dependencies (#​23445) (fc7c104)
• html: don't inline preload link targets (fix #​13355) (#​23387) (12e709c)
• resolve the actual package root in findNearestMainPackageData for nested package.json (#​23356) (8492422)
• shortcuts extend error (#​23447) (4ec58d1)
• config: close bundles when generation fails (#​23256) (6bacc95)
• css: keep newline-separated srcset candidates intact (#​23265) (4f9d2f4)
• deps: update all non-major dependencies (#​23337) (d550815)
• deps: update all non-major dependencies (#​23404) (238ad81)
• deps: update rolldown-related dependencies (#​23338) (76e8082)
• deps: update rolldown-related dependencies (#​23405) (b882566)
• dev: run closeBundle after buildEnd failure (#​23165) (8cb872e)
• hmr: handle import.meta.hot.invalidate in virtual module (#​23171) (6162968)
• utils: handle dot in srcset density descriptor (#​23346) (b50e1b4)
• utils: match timestamp query parameter with proper delimiters (#​23364) (41f3c6f)

Performance Improvements

• proxy: pre-compile context matchers at server creation (#​23263) (8abf700)

Miscellaneous Chores

• introducing @e18e/eslint-plugin (#​23357) (f794133)
• remove unnecessary comment (#​23448) (b919a1a)
• delete unused PluginContainerOptions (#​23382) (ee64401)
• use oxfmt sortImports (#​23319) (97ad042)

Code Refactoring

• delete unused esbuildPlugin (#​23381) (f40efef)
• exclude postfix from __VITE_ASSET__ (#​22886) (a6c08e1)
• remove HmrUrl concept (#​23172) (67a6807)
• use urlId of import.meta.ROLLDOWN_FILE_URL in wasm plugin (#​22962) (92bd2a7)

Tests

• add renderBuiltUrl change changes hash (#​23118) (0291408)

Beta Changelogs

8.3.0-beta.1 (2026-09-07)

See 8.3.0-beta.1 changelog

8.3.0-beta.0 (2026-09-02)

See 8.3.0-beta.0 changelog

v8.2.1

Compare Source

Bug Fixes

• build: make client chunkImportMap work with sharedPlugins: true (#​23184) (15f0307)
• bundled-dev: inject client script tag before chunk scripts (#​23161) (eac0cc8)
• css: don't re-run lightningcss visitor during minify (fix #​23146) (#​23147) (de041a7)
• deps: update all non-major dependencies (#​23136) (14454fd)
• deps: update rolldown-related dependencies (#​23070) (7ac6f7f)
• don't mutate the user config when resolving the lib entry from the top-level input (#​23135) (b4bf596)
• handle shebang ending with uncommon line terminators (#​23038) (17f7b2f)
• server: use a random port when port is 0 (#​23158) (fddf4ea)

Performance Improvements

• css: look up pure CSS chunks through a Set (#​23114) (1331b0b)

Documentation

• build: fix incomplete @default for build.minify (#​23177) (ef02435)

Miscellaneous Chores

• deps: update dependency rolldown-plugin-dts to ^0.28.0 (#​23137) (4adc1e7)
• deps: update dependency strip-literal to v4 (#​23140) (9db65ce)

Code Refactoring

• bundled-dev: avoid injecting server values in the bundle (#​22967) (23b8a08)
• bundled-dev: remove rolldown lazy stub module workaround (#​23129) (e72036e)

Tests

• bundled-dev: enable sourcemap playgrounds (#​23080) (c2155fe)
• reduce logs (#​23138) (7673c02)

v8.2.0

Compare Source

Features

• add input to server.fs.allow (#​23035) (95a3cda)
• bundled-dev: reload once after rebuild instead of via the fallback page (#​23106) (b24381d)
• bundled-dev: support worker file update accepted by HMR (#​23068) (0d04351)
• config: include column in config incompatibility location (#​23064) (8a24572)
• dev: resolve interface name for explicit host in network URLs (#​22965) (3ac77d9)
• add input option (#​22642) (9beae37)
• config: warn features incompatible with native loader in bundle loader (#​22850) (05302b0)
• css: export PostCSS config type for type-safe configs (#​22792) (302c755)
• dev: label network URLs with their interface name (#​22830) (78accc4)
• optimizer: support aube lockfile (#​22813) (6319827)
• optimizer: support nub lockfile (#​22891) (65d3604)
• update rolldown-related dependencies and use client-side HMR in bundled-dev (#​22961) (960e9ef)
• wasm: expand test suite, unwrap WebAssembly.Global and enable js-string builtins (#​22674) (9e79b51)

Bug Fixes

• bundledDev: print build errors to the terminal when an HMR update fails (#​23024) (41c4658)
• deps: update all non-major dependencies (#​23069) (4c07b74)
• hmr: preserve environment snapshot during server restart (#​22992) (b1186c3)
• importAnalysis: interop imports injected into optimized dep files by plugins (#​23029) (8c2a87d)
• module-runner: keep stack trace interception working when Object.prototype is frozen (#​23073) (599c5b0)
• server: strip base in indexHtml module graph lookup (#​22932) (fa005d1)
• support resolving top-level input option with plugins (#​23101) (41df81a)
• build: map CSS chunks in chunk import maps (fix #​22946) (#​22947) (e16ff3a)
• config: exclude virtual modules from native config compat check (#​22979) (2ced1fe)
• css: rewrite urls in OnceExit-injected content (#​22983) (abb793e)
• deps: update all non-major dependencies (#​22985) (04f345b)
• deps: update dependency magic-string to v1 (#​22998) (c60b4d7)
• hmr: remove hot data after prune (#​23002) (be96316)
• resolve root to real path (#​22832) (55bba7b)

Performance Improvements

• config: skip native config compat check when warning is ignored (#​23000) (18535d1)
• optimizer: check popular package manager lockfiles first (#​22909) (14fcb66)

Documentation

• config: correct cacheDir default fallback description (#​23060) (aafa103)
• remove @experimental from resolve.tsconfigPaths JSDoc (#​23006) (961643a)

Miscellaneous Chores

• fix ts erros in test cases (#​22972) (f654769)

Tests

• config CJS module vars in ESM case (#​23010) (d8cd388)

Beta Changelogs

8.2.0-beta.0 (2026-07-22)

See 8.2.0-beta.0 changelog

v8.1.6

Compare Source

Please refer to CHANGELOG.md for details.

v8.1.5

Compare Source

Features

• add input to server.fs.allow (#​23035) (95a3cda)
• bundled-dev: reload once after rebuild instead of via the fallback page (#​23106) (b24381d)
• bundled-dev: support worker file update accepted by HMR (#​23068) (0d04351)
• config: include column in config incompatibility location (#​23064) (8a24572)
• dev: resolve interface name for explicit host in network URLs (#​22965) (3ac77d9)
• add input option (#​22642) (9beae37)
• config: warn features incompatible with native loader in bundle loader (#​22850) (05302b0)
• css: export PostCSS config type for type-safe configs (#​22792) (302c755)
• dev: label network URLs with their interface name (#​22830) (78accc4)
• optimizer: support aube lockfile (#​22813) (6319827)
• optimizer: support nub lockfile (#​22891) (65d3604)
• update rolldown-related dependencies and use client-side HMR in bundled-dev (#​22961) (960e9ef)
• wasm: expand test suite, unwrap WebAssembly.Global and enable js-string builtins (#​22674) (9e79b51)

Bug Fixes

• bundledDev: print build errors to the terminal when an HMR update fails (#​23024) (41c4658)
• deps: update all non-major dependencies (#​23069) (4c07b74)
• hmr: preserve environment snapshot during server restart (#​22992) (b1186c3)
• importAnalysis: interop imports injected into optimized dep files by plugins (#​23029) (8c2a87d)
• module-runner: keep stack trace interception working when Object.prototype is frozen (#​23073) (599c5b0)
• server: strip base in indexHtml module graph lookup (#​22932) (fa005d1)
• support resolving top-level input option with plugins (#​23101) (41df81a)
• build: map CSS chunks in chunk import maps (fix #​22946) (#​22947) (e16ff3a)
• config: exclude virtual modules from native config compat check (#​22979) (2ced1fe)
• css: rewrite urls in OnceExit-injected content (#​22983) (abb793e)
• deps: update all non-major dependencies (#​22985) (04f345b)
• deps: update dependency magic-string to v1 (#​22998) (c60b4d7)
• hmr: remove hot data after prune (#​23002) (be96316)
• resolve root to real path (#​22832) (55bba7b)

Performance Improvements

• config: skip native config compat check when warning is ignored (#​23000) (18535d1)
• optimizer: check popular package manager lockfiles first (#​22909) (14fcb66)

Documentation

• config: correct cacheDir default fallback description (#​23060) (aafa103)
• remove @experimental from resolve.tsconfigPaths JSDoc (#​23006) (961643a)

Miscellaneous Chores

• fix ts erros in test cases (#​22972) (f654769)

Tests

• config CJS module vars in ESM case (#​23010) (d8cd388)

Beta Changelogs

8.2.0-beta.0 (2026-07-22)

See 8.2.0-beta.0 changelog

v8.1.4

Compare Source

Features

• legacy: prefer oxc as minifier (fix #​21973) (#​22468) (ab5dafa)

Bug Fixes

• build: add workaround for building on stackblitz (#​22840) (575c32c)
• build: keep import.meta.url in preload function as-is (#​22839) (f1f90ed)
• deps: update all non-major dependencies (#​22865) (d4295a9)
• deps: update rolldown-related dependencies (#​22866) (7cf07e4)
• html: avoid backtracking in import-only check (#​22848) (b5868c0)
• optimizer: avoid optimizer run for transform request before init (#​22852) (72a5e21)
• ssr: align named export function call stacktrace column with Node (#​22829) (173a1b6)
• strip pure CSS chunk imports when chunkImportMap is enabled (#​22841) (648bd04)

Documentation

• fix incorrect @default for server.cors (#​22859) (70435b2)

Miscellaneous Chores

• deps: update dependency postcss-modules to v9 (#​22867) (a9539d6)

Code Refactoring

• eliminate ineffectiveDynamicImport warn (#​22876) (ea22fb3)

Tests

• avoid warnings (#​22851) (af21ab6)

Build System

• remove the custom onLog function (#​22878) (2c4a217)
• replace deprecated onwarn with onLog (#​22741) (c581b55)

v8.1.3

Compare Source

Bug Fixes

• css: inject inlined CSS after the shebang line (#​22717) (1534d36)
• deps: bump es-module-lexer to 2.3.0 (#​22838) (7103c3a)
• preload css for nested dynamic imports (#​22759) (2c53054)
• ssr: correct stacktrace column position for first line (#​22828) (c4acd69)

v8.1.2

Compare Source

Bug Fixes

• deps: revert es-module-lexer to 2.1.0 (#​22827) (0d3bd7c)
• restore, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#​22757)" (#​22825) (efb98cc)
• revert, "fix: escape ids with multiple null bytes (#​22687)" (cccef55)
• revert, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#​22757)" (cf97711)

v8.1.1

Compare Source

Features

• update dynamic import warning to link to Vite docs (#​22823) (62bd7af)

Bug Fixes

• bundled-dev: avoid stack overflow on import.meta.hot.invalidate() (#​22797) (709eb8e)
• bundled-dev: serve assets emitted during HMR/lazy compile (#​22745) (5876b2c)
• bundledDev: skip plugin transform hooks for rolldown-lazy stub modules (#​22778) (8f925e2)
• css: preserve dollar signs in external @import urls with lightningcss (#​22718) (9fa7ab4)
• css: resolve tsconfig paths in CSS and Sass @​import (#​22775) (ef0b891)
• deps: update all non-major dependencies (#​22734) (e635f49)
• deps: update all non-major dependencies (#​22804) (8837400)
• deps: update rolldown-related dependencies (#​22591) (2ce6677)
• escape ids with multiple null bytes (#​22687) (833fc30)
• hide console window when running 'net use' on Windows (#​22698) (92b63f2)
• ignore bundled config temp dir (#​22800) (043a810)
• invert esbuild.jsxSideEffects when converting to oxc.jsx.pure (#​22809) (33895ba)
• optimize-deps: ignore ERR_CLOSED_SERVER in scanner (#​22784) (085a0ab)
• optimizer: scanner should resolve input from root (#​22769) (9722b07)
• resolve pnpm .modules.yaml from workspace root instead of cwd (#​22757) (2531ac7)
• return sourcemap field from some plugins that were lacking (#​22782) (7e18bf8)
• server: handle malformed URI in indexHtmlMiddleware (#​22781) (84f5ccc)

Miscellaneous Chores

• improve dependency optimizer messages (#​22549) (092cb3b)

Code Refactoring

• css: remove lightningcss null byte bug workaround (#​22822) (2dafd3b)
• use pre-defined environments variable to avoid duplicate Object.values calls (#​22790) (1113acf)

Tests

• enable "manual chunk path" test and remove "worker.format error" test (#​22824) (c088511)