Vite and launch-editor: editor flag injection and path check bypasses

published 2026-10-20

Flaws in the Vite dev server and its launch-editor helper let a crafted request inject command-line flags into the editor it opens, get past its Windows path checks or bypass its fs.allow file limits.

Fixed in: 8.3.3

CVE: CVE-2026-112942, CVE-2026-112943, CVE-2026-112944, CVE-2026-112946

Source: GitHub Advisory

Am I affected?

You are affected if the installed version is older than 8.3.3. Check the version you have and update to 8.3.3 or later. The fixed version is verified against a vendor or advisory source.

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 1799 and your operating system.