The launch-editor library forwards editor filenames to the selected editor without enforcing them as positional arguments. When an attacker controls the creation of a file whose name starts with "+" or "-", the filename is interpreted as a command‐line flag by editors such as Vim, gVim, MacVim, Emacs, Emacsclient, and Notepad++ when a plugin permits unsafe operations. This misinterpretation can result in unintended file overwrites or arbitrary command execution within the context of the editor. The vulnerability is rated with a CVSS score of 6.3, indicating moderate severity.

The flaw affects the ViteJS launch-editor component, as well as the vite and vite-plus packages that use it, for all releases prior to version 2.14.2. The issue was addressed in launch‑editor release 2.14.2, which removes the unvalidated path forwarding logic.

The CVSS score of 6.3 signals that the flaw is meaningful but not critical; the EPSS score is unavailable, so the expected exploitation likelihood is unknown. Since the vulnerability depends on an attacker’s ability to create a filesystem entry beginning with "+" or "-" in a process’s working directory, it is generally a local privilege escalation or development‑environment compromise scenario rather than a remote network exploit. The exception is that any editor capable of interpreting the forged flag can execute arbitrary commands, so a compromised editor can lead to full system compromise for the running user.