npm: launch-editor: escapeCmdArgs() omits % escaping on Windows

npm: launch-editor: escapeCmdArgs omits % escaping on Windows vulnerability discovered by ? in WordPress npm launch-editor versions = 2.14.1...

npm: launch-editor: escapeCmdArgs() omits % escaping on Windows

npm: launch-editor: escapeCmdArgs omits % escaping on Windows vulnerability discovered by ? in WordPress npm vite-plus versions = 1.0.0...

npm: launch-editor: escapeCmdArgs() omits % escaping on Windows

npm: launch-editor: escapeCmdArgs omits % escaping on Windows vulnerability discovered by ? in WordPress npm vite versions = 6.4.3...

launch-editor: escapeCmdArgs() omits % escaping on Windows

Summary launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. Impact Only apps that match all of the following conditions are affected: - The user uses Windows - An...

GHSA-698V-4R3X-3VCV launch-editor: escapeCmdArgs() omits % escaping on Windows

Summary launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. Impact Only apps that match all of the following conditions are affected: - The user uses Windows - An...

CVE-2026-112943

The launch-editor Node.js package (prior to version 2.14.2 ) is vulnerable to OS Command Injection on Windows systems. The root cause is that the escapeCmdArgs() function fails to escape the % character when passing arguments to cmd . If an environment variable contains malicious values, it could...

CVE-2026-112943 launch-editor: escapeCmdArgs() omits % escaping on Windows

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This...

CVE-2026-112943 launch-editor: escapeCmdArgs() omits % escaping on Windows

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This...

CVE-2026-112943 launch-editor: escapeCmdArgs() omits % escaping on Windows

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This...