CVE-2026-112944
MediumAdvisory
Published 20 Oct 2026In the index since 21 Oct 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.3
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 97
- of 18,208 indexed, latest versions
- Container images
- 100
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
Carried by container images the latest versions of 97 of 18,208 indexed charts deploy, on 100 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| vitenpm | 2.9.15, 3.2.5, 3.2.7, 3.2.8+39 more | 6.4.4, 7.3.7, 8.1.6, 8.2.4+1 more | 62 |
| launch-editornpm | 2.2.1, 2.3.0, 2.4.0, 2.6.0+6 more | 2.14.2 | 40 |
- OSV records
- GHSA-r825-w8mm-5pxw
Charts affected
97 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| penpotpenpotOfficialVerified publisher | 1.11.3 | 1 of 5See more | 6,129 |
| lemmyananace-chartsVerified publisher | 0.6.15 | 1 of 5See more | 8,180 |
| openclawopenclaw-helmVerified publisher | 1.5.40 | 1 of 2See more | 6,685 |
| outlinekubitodevVerified publisher | 1.2.2 | 1 of 4See more | 6,461 |
| outlineoutline | 0.0.9 | 1 of 4See more | 5,649 |
| syftopenmined | 0.9.5 | 1 of 6See more | 21,802 |
| misskeyalytiVerified publisher | 1.0.0 | 1 of 1See more | 5,653 |
| klusterviewklusterviewVerified publisher | 0.1.0 | 1 of 4See more | 3,908 |
| headplanenbcloudVerified publisher | 0.1.2 | 1 of 4See more | 10,325 |
| convertigoconvertigoOfficialVerified publisher | 8.4.6 | 1 of 5See more | 17,635 |
| mealiegeek-cookbookVerified publisher | 5.1.2 | 1 of 2See more | 9,555 |
| pretixtechwolf12Verified publisher | 2026.8.0 | 1 of 3See more | 10,080 |
| feedbacksystemthm-mni-iiVerified publisher | 0.48.3 | 1 of 14See more | 30,407 |
| nocodbzekker6Verified publisher | 1.10.0 | 1 of 1See more | 5,618 |
| aapbaapbVerified publisher | 0.1.3 | 1 of 1See more | 988 |
| hermes-agentankra-chartsVerified publisher | 0.3.1 | 1 of 1See more | 7,885 |
| betterdb-monitorbetterdb-monitorOfficialVerified publisher | 0.49.0 | 1 of 1See more | 683 |
| data-fairdata354-helmVerified publisher | 1.1.2 | 6 of 12See more | 43,506 |
| kubedashdevopstalesOfficialVerified publisher | 4.0.0 | 1 of 8See more | 12,885 |
| directusdirectus-io | 2.1.0 | 1 of 3See more | 9,890 |
| jellystatdjjudas21Verified publisher | 1.0.1 | 1 of 1See more | 2,132 |
| ethereumjsethereum-helm-chartsVerified publisher | 0.1.2 | 1 of 2See more | 2,286 |
| recipesgeek-cookbookVerified publisher | 6.6.2 | 1 of 2See more | 8,862 |
| kenerkenerVerified publisher | 0.2.0 | 1 of 1See more | 6,339 |
| dashykrzwiatrzyk | 1.0.0 | 1 of 1See more | 3,367 |
| plane-enterprisemakeplaneOfficialVerified publisher | 3.10.11 | 3 of 13See more | 7,053 |
| openvaultopenvaultVerified publisher | 0.9.0 | 1 of 2See more | 8,176 |
| portraitportraitVerified publisher | 0.2.13 | 1 of 8See more | 37,593 |
| testhubteshubVerified publisher | 0.1.4 | 1 of 3See more | 8,769 |
| unitycatalogunitycatalogVerified publisher | 0.0.2 | 1 of 4See more | 14,152 |
| adeptia-automate-mcpadeptia-automate-mcp | 1.0.0 | 1 of 2See more | 4,435 |
| activepiecesadnoctemVerified publisher | 0.7.2 | 1 of 1See more | 2,010 |
| outlineadnoctemVerified publisher | 0.1.3 | 1 of 1See more | 1,578 |
| homepagealareira | 1.0.1 | 1 of 1See more | 682 |
| apimap-developerapimapOfficialVerified publisher | 1.4.1 | 1 of 1See more | 2,713 |
| apimap-portalapimapOfficialVerified publisher | 2.4.0 | 1 of 1See more | 2,758 |
| astrotrekastria | 0.0.2 | 1 of 4See more | 37,777 |
| cloudpremcloudprem | 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad | 3 of 6See more | 23,218 |
| coderstudio-strapi-devcoderstudio-strapi-devVerified publisher | 0.0.1 | 1 of 3See more | 6,155 |
| docker-composecoderstudio-strapi-devVerified publisher | 0.0.1 | 1 of 3See more | 6,155 |
| strapi-devcoderstudio-strapi-devVerified publisher | 0.0.1 | 1 of 3See more | 6,155 |
| directusdirectusVerified publisher | 0.9.10 | 1 of 4See more | 5,572 |
| dumpstoredumpstore | 0.1.1 | 1 of 2See more | 5,226 |
| lodestarethereum-helm-chartsVerified publisher | 1.2.2 | 1 of 2See more | 3,215 |
| facetflanksourceVerified publisher | 0.1.73 | 1 of 1See more | 27,409 |
| redis-uigin | 0.0.1 | 1 of 1See more | 1,402 |
| web-checkhajowielandVerified publisher | 1.0.1 | 1 of 1See more | 6,266 |
| automatischhelmforgeVerified publisher | 1.3.12 | 1 of 4See more | 6,497 |
| hermes-agenthelmforgeVerified publisher | 1.0.2 | 1 of 1See more | 7,193 |
| paprahelmforgeVerified publisher | 1.0.2 | 1 of 1See more | 3,638 |
Container images carrying it
100 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| rcdelacruz/ | 38007f358355 | launch-editor | 2.14.2 | 3 |
| openbas/ | a277796d9724 | vite | 6.4.4 | 2 |
| outlinewiki/ | d060dcd8f9aa | vite | 6.4.4 | 2 |
| patrikx3/ | f19eb45b0694 | vite | 8.2.4 | 2 |
| ghcr.io/ | 643bd0be730d | vite | 8.2.4 | 2 |
| ghcr.io/ | acb40032ad4b | launch-editor | 2.14.2 | 2 |
| activepieces/ | 26daa5e1807f | vite | 6.4.4 | 1 |
| adeptiainc/ | 283001e83739 | vite | 7.3.7 | 1 |
| anamskenneth/ | 9ecf04f42cc3 | vite | 6.4.4 | 1 |
| apimap/ | 406d3858e20c | launch-editor | 2.14.2 | 1 |
| apimap/ | 041a4790c65c | launch-editor | 2.14.2 | 1 |
| automatischio/ | 3bace7a12d5f | vite | 6.4.4 | 1 |
| baserow/ | df0c42eb67e8 | launch-editor | 2.14.2 | 1 |
| betterdb/ | 97dcd2d2192f | vite | 8.1.6 | 1 |
| ccjacobs14/ | 9a9b14a6f09e | launch-editor | 2.14.2 | 1 |
| chainsafe/ | 7b9fe4aa8073 | vite | 6.4.4 | 1 |
| chainsafe/ | f3d339e96267 | vite | 6.4.4 | 1 |
| cyfershepard/ | e61c759ec706 | vite | 8.1.6 | 1 |
| dessalines/ | ee4c620d8e93 | launch-editor | 2.14.2 | 1 |
| directus/ | 9c8470ea465c | vite | 8.1.6 | 1 |
| directus/ | e3c8bb975350 | vite | 6.4.4 | 1 |
| ethereumoptimism/ | e07968a0e686 | vite | 6.4.4 | 1 |
| ethpandaops/ | fb84b718500f | vite | 7.3.7 | 1 |
| hecrom/ | 5454b54d5b28 | launch-editor | 2.14.2 | 1 |
| helga09/ | 7999bc8b77c0 | launch-editor | 2.14.2 | 1 |
| hkotel/ | 3c04c0e85039 | launch-editor | 2.14.2 | 1 |
| honglab/ | ca075a926fe1 | vite | 6.4.4 | 1 |
| joplin/ | 52af57880c0e | launch-editor | 2.14.2 | 1 |
| kitware/ | da5abe941506 | launch-editor | 2.14.2 | 1 |
| kyleslugg/ | ba8c36dfdfbd | launch-editor | 2.14.2 | 1 |
| lavandadelpatio/ | 501c3f31e0bc | launch-editor | 2.14.2 | 1 |
| leonardomulticloud/ | e42a341e0299 | launch-editor | 2.14.2 | 1 |
| lissy93/ | 1991f7be5ed0 | launch-editor | 2.14.2 | 1 |
| makeplane/ | fab034a2be8c | vite | 8.2.4 | 1 |
| makeplane/ | 12c33418c1ec | vite | 8.2.4 | 1 |
| makeplane/ | c4a6236c4080 | vite | 8.2.4 | 1 |
| misskey/ | e08b7c478093 | launch-editor | 2.14.2 | 1 |
| mitchxxx/ | 4e72480ec63a | launch-editor | 2.14.2 | 1 |
| moonrailgun/ | b528c8f8fcc4 | vite | 6.4.4 | 1 |
| nocodb/ | d9516f0bf546 | launch-editor | 2.14.2 | 1 |
| nousresearch/ | e0df6adebddf | vite | 8.2.4 | 1 |
| nousresearch/ | fca358f12efd | vite | 8.2.4 | 1 |
| ondrejsika/ | b1fd497416c8 | launch-editor | 2.14.2 | 1 |
| ooghenekaro/ | 03394ba1d6d8 | launch-editor | 2.14.2 | 1 |
| opea/ | 2bee4eb66f3e | vite | 6.4.4 | 1 |
| opea/ | 3ef121f34610 | vite | 6.4.4 | 1 |
| opea/ | 7f854e9bffaf | vite | 6.4.4 | 1 |
| openmined/ | d11524a3854a | vite | 6.4.4 | 1 |
| outlinewiki/ | 08ee9ffdb847 | vite | 8.3.3 | 1 |
| outlinewiki/ | 494dfb9249a6 | vite | 6.4.4 | 1 |