The bug resides in launch‑editor’s Windows command–argument handling, where percent signs (%) were not escaped before being forwarded to cmd.exe. An attacker who can influence an environment variable read by the Node.js process can inject a payload that becomes part of the command string and is executed by cmd, giving arbitrary code execution. This is a classic command injection flaw (CWE‑78).

The issue is present in the Vite.js ecosystem, specifically launch‑editor package versions earlier than 2.14.2 and any projects that depend on it, such as Vite and Vite‑plus. Any installation that imports launch‑editor before the 2.14.2 release is vulnerable.

The CVSS score of 6.3 indicates a medium severity. EPSS data is currently unavailable and the vulnerability is not listed in CISA KEV, implying no large‑scale exploitation yet. The exploit requires control over an environment variable that leaks into the Node.js process, a condition that can occur if user input feeds into env vars or when running untrusted code. Once achieved, the attacker can run arbitrary commands on the host system, creating a high‑impact threat if the process runs with privileged rights.