3nit-utils (>=0.24.0, <=1.0.2), 6ix (0.0.0-canary.0) +318 more potentially affected by CVE-2026-112942 via launch-editor (>=1.0.0, <=2.14.1)

launch-editor NPM version =1.0.0, =0.24.0, =0.0.0-canary.0, =0.0.1, =7.0.2, =1.0.0, =0.4.0, =0.1.0, =0.3.0, =1.0.0, =0.2.0, =0.2.10 - @carnesen/www 0.1.0 - @catapult-tech/cp-design-system-site 1.0.0 - @caviar/cli 0.0.1 and more Source cves: CVE-2026-112942 Source advisory: MEND:CVE-2026-112942...

CVE-2026-28854

The issue was addressed with additional app bundle integrity checks. This issue is fixed in macOS Golden Gate 27. A maliciously modified app may not be prevented from launching...

CVE-2026-28854

The issue was addressed with additional app bundle integrity checks. This issue is fixed in macOS Golden Gate 27. A maliciously modified app may not be prevented from launching...

CVE-2026-28854

Versions of Apple macOS Golden Gate prior to version 27 are vulnerable to a flaw caused by insufficient integrity checks on application packages. This vulnerability could allow maliciously modified applications to be launched without being prevented by the system. This issue is fixed in macOS Gol...

CVE-2026-28854

The issue was addressed with additional app bundle integrity checks. This issue is fixed in macOS Golden Gate 27. A maliciously modified app may not be prevented from launching...

CLEANSTART-2026-AX01759 launch-editor allows users to open files with line numbers in editor from Node

CVE-2026-53632 affects multiple packages. launch-editor allows users to open files with line numbers in editor from Node. See references for individual vulnerability details...

PT-2026-118403

Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.2 Description On Windows, the launch-editor-middleware processes a file argument that can be manipulated to bypass filename existence validation. When a file argument ends with a parent-directory component...

PT-2026-120321

Summary launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution. Impact Direct launch-editor users Only apps that match all of t...

PT-2026-118404

Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.2 Description On Windows, the software fails to escape the % character when passing arguments to cmd.exe. This occurs because .bat or .cmd files cannot be called directly via child process.spawn and must be...

PT-2026-118405

Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.2 Description The launchEditor function forwards file paths to editors without proper sanitization. If an attacker can create a filesystem entry starting with a plus + or minus - sign in the working...

PT-2026-120301

Summary launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. Impact Only apps that match all of the following conditions are affected: - The user uses Windows - An...

PT-2026-120298

Summary launch-editor checked fs.existsSyncfileName before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in ..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename...

Vite launch-editor command injection vulnerability

Versions of Vite launch-editor prior to 2.14.2 have a command injection vulnerability. This vulnerability arises from the lack of escaping of the percent symbol when parameters are passed to cmd on Windows. When environmental variables contain malicious values, it may lead to the execution of...

Vite launch-editor command injection vulnerability

Vite launch-editor has a command injection vulnerability. This vulnerability arises when an attacker can create file system entries in the working directory that start with a plus sign or minus sign. In such cases, launch-editor does not enforce the path as a positional file name. As a result, th...

Vite launch-editor command injection vulnerability

Versions of launch-editor prior to 2.14.2 have a command injection vulnerability. This vulnerability arises from launch-editor-middleware removing the row and column suffixes before the existsSync check when processing Windows file parameters controlled by attackers. As a result, parameters pass...

CVE-2026-21129

Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges...

EUVD-2026-97193

Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges...

PT-2026-110457

Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges...

PT-2026-106748

Name of the Vulnerable Software and Affected Versions Microsoft UFO versions prior to 3.0.9 Description The run shell tool within the CommandLineExecutor component of ufo/client/mcp/local servers/cli mcp server.py incorrectly validates the bash command parameter by only checking the first token...

CLEANSTART-2026-XZ43182 launch-editor allows users to open files with line numbers in editor from Node

Security vulnerability affects the argo-workflows package. launch-editor allows users to open files with line numbers in editor from Node...