CVE-2026-112944

Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.2

Description The launchEditor() function forwards file paths to editors without proper sanitization. If an attacker can create a filesystem entry starting with a plus (+) or minus (-) sign in the working directory, the editor may interpret the filename as a command-line flag instead of a positional filename. This can lead to unintended file overwrites or arbitrary command execution. Affected editors include Vim, gVim, MacVim, Emacs, Emacsclient, and Notepad++ (when a plugin exposes dangerous operations). This issue persists for users of WSL (Windows Subsystem for Linux) because paths are converted to relative paths internally.

Recommendations Update to version 2.14.2 or later.