7 matches found
GHSA-587H-7WMJ-H5PM launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
Summary launch-editor checked fs.existsSyncfileName before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in \..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename...
7.5CVSS6AI score
SaveExploits0References5
20