The vulnerability exists in launch-editor, a helper in Vite that lets Node.js applications request a text editor to open a file with a line number. In versions before 2.14.2, the middleware accepts a file argument that ends with a parent-directory component and a line-and-column suffix. When resolving the path the suffix remains, and launch-editor removes it only after an existsSync check, allowing the check to succeed on the parent directory even though the requested file does not exist. The attacker can craft the argument to bypass the existence validation and trigger the percent-expansion flaw described elsewhere, leading to OS command injection, which could give an attacker arbitrary command execution on the host system.

The flaw affects applications that depend on vitejs launch-editor, vitejs vite, and vitejs vite-plus, all versions prior to 2.14.2. No specific patch versions were listed beyond that, so all earlier releases remain vulnerable.

The CVSS score of 7.5 indicates a high‑severity risk, while the EPSS score is 1%, indicating a very low but nonzero exploitation probability. Because the flaw permits command execution only when combined with the percent‑expansion vulnerability, an attacker must have a vulnerable Windows environment that supports that defect. The vulnerability is not listed in CISA KEV, suggesting no confirmed public exploitation yet, yet the high severity warrants immediate mitigation.