SCA: security update for launch-editor, vite, vite-plus (GHSA-587h-7wmj-h5pm)

high Tenable Cloud Security Plugin ID 476374

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2,
launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument
ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix
is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing
parent directory for existsSync and allowing the attacker-controlled file argument to pass filename
existence validation without requiring the malicious filename to exist. The bypass can lead to OS command
injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed
in version 2.14.2. (CVE-2026-112942)

Solution

Update the vite-plus library and its related packages to version 1.1.0 or later.

Plugin Details

Severity: High

ID: 476374

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/20/2026

Updated: 10/20/2026

Risk Information

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-112942

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.5

Threat Score: 4.8

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/20/2026

Vulnerability Publication Date: 10/20/2026

Reference Information

CVE: CVE-2026-112942

cwe: CWE-77

Detections

Analytics