GHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

• npm launch-editor: < 2.14.2 → fixed in 2.14.2 • npm vite: >= 8.3.0, < 8.3.3 → fixed in 8.3.3 • npm vite: >= 8.2.0, < 8.2.4 → fixed in 8.2.4 • npm vite: >= 8.0.0, < 8.1.6 → fixed in 8.1.6 • npm vite: >= 7.0.0, < 7.3.7 → fixed in 7.3.7 • npm vite: < 6.4.4 → fixed in 6.4.4 • npm vite-plus: < 1.1.0 → fixed in 1.1.0

Summary `launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution. Impact Direct `launch-editor` users Only apps that match all of the following conditions are affected: • The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory • The user uses or the app specifies any of the following editors: • Vim (including gVim) • MacVim • Emacs (including Emacsclient) • Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) • The first argument of `launchEditor` can start with `+` or `-` or the user is using WSL `launch-editor-middleware` users Only apps that match the following conditions are affected: • The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory • The user uses or the app specifies any of the following editors: • Vim (including gVim) • MacVim • Emacs (including Emacsclient) • Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) • launch-editor older than v2.2.0 is used, or the user is using WSL Vite users Only apps that match the following conditions are affected: • The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory • The user uses or the app specifies any of the following editors: • Vim (including gVim) • MacVim • Emacs (including Emacsclient) • Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) • The user is using WSL Details `launchEditor(file)` function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with `-` (also `+` for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with `+` as an Ex command. As a result, an existing relative directory such as: ``` +call writefile(["SAFE_MARKER"],"LAUNCH_EDITOR_MARKER")|qa! ``` is not treated as a filename when passed to Vim. Vim executes the embedded Ex command. The following editor has a potentially destructive operation exposed to the CLI arguments: • Vim (including gVim) • MacVim • Emacs (including Emacsclient) • Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) `launch-editor-middleware` v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, `launch-editor` converts the paths to relative paths internally, so those are still affected. Vite 2.0.0+ uses `launch-editor-middleware` v2.2.0+ so the WSL users are only affected.