Arbitrary Command Injection

Overview vite-plus is a The Unified Toolchain for the Web Affected versions of this package are vulnerable to Arbitrary Command Injection via the parseFile function in packages/launch-editor/index.js, which previously resolved file paths only after stripping position suffixes without calling...

3nit-utils (>=0.24.0, <=1.0.2), 6ix (0.0.0-canary.0) +317 more potentially affected by CVE-2026-112942 via launch-editor (>=2.2.1, <=2.14.1)

launch-editor NPM version =2.2.1, =0.24.0, =0.0.0-canary.0, =0.0.1, =7.0.2, =1.0.0, =0.4.0, =0.1.0, =0.3.0, =1.0.0, =0.2.0, =0.2.10 - @carnesen/www 0.1.0 - @catapult-tech/cp-design-system-site 1.0.0 - @caviar/cli 0.0.1 and more Source cves: CVE-2026-112942 Source advisory:...

GHSA-587H-7WMJ-H5PM launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

Summary launch-editor checked fs.existsSyncfileName before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in \..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename...

Arbitrary Command Injection

Overview launch-editor is a launch editor from node.js Affected versions of this package are vulnerable to Arbitrary Command Injection via the parseFile function in packages/launch-editor/index.js, which previously resolved file paths only after stripping position suffixes without calling...

npm: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

npm: launch-editor: fs.existsSync existence check can be bypassed on Windows vulnerability discovered by ? in WordPress npm launch-editor versions = 2.14.1...

Arbitrary Command Injection

Overview org.webjars.npm:vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Arbitrary Command Injection via the parseFile function in packages/launch-editor/index.js, which previously resolved file paths only after stripping position suffixes witho...

CVE-2026-112944

A flaw was found in launch-editor. This vulnerability can lead to arbitrary command execution or unintended file overwrite due to improper handling of file paths when invoking external text editors. An attacker capable of creating files with leading special characters in the working directory can...

npm: launch-editor: escapeCmdArgs() omits % escaping on Windows

npm: launch-editor: escapeCmdArgs omits % escaping on Windows vulnerability discovered by ? in WordPress npm launch-editor versions = 2.14.1...

3nit-utils (>=0.24.0, <=1.0.2), 6ix (0.0.0-canary.0) +317 more potentially affected by CVE-2026-112943 via launch-editor (>=2.2.1, <=2.14.1)

launch-editor NPM version =2.2.1, =0.24.0, =0.0.0-canary.0, =0.0.1, =7.0.2, =1.0.0, =0.4.0, =0.1.0, =0.3.0, =1.0.0, =0.2.0, =0.2.10 - @carnesen/www 0.1.0 - @catapult-tech/cp-design-system-site 1.0.0 - @caviar/cli 0.0.1 and more Source cves: CVE-2026-112943 Source advisory: GHSA-698V-4R3X-3VCV...

Command Injection

Overview launch-editor is a launch editor from node.js Affected versions of this package are vulnerable to Command Injection via constructWindowsLaunchCommand in packages/launch-editor/construct-windows-launch-command.js, where file path arguments containing % characters are passed unsanitized to...

npm: launch-editor: escapeCmdArgs() omits % escaping on Windows

npm: launch-editor: escapeCmdArgs omits % escaping on Windows vulnerability discovered by ? in WordPress npm vite-plus versions = 1.0.0...

npm: launch-editor: escapeCmdArgs() omits % escaping on Windows

npm: launch-editor: escapeCmdArgs omits % escaping on Windows vulnerability discovered by ? in WordPress npm vite versions = 6.4.3...

launch-editor: escapeCmdArgs() omits % escaping on Windows

Summary launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. Impact Only apps that match all of the following conditions are affected: - The user uses Windows - An...

3nit-utils (>=0.24.0, <=1.0.2), 6ix (0.0.0-canary.0) +317 more potentially affected by CVE-2026-112943 via launch-editor (>=2.2.1, <=2.14.1)

launch-editor NPM version =2.2.1, =0.24.0, =0.0.0-canary.0, =0.0.1, =7.0.2, =1.0.0, =0.4.0, =0.1.0, =0.3.0, =1.0.0, =0.2.0, =0.2.10 - @carnesen/www 0.1.0 - @catapult-tech/cp-design-system-site 1.0.0 - @caviar/cli 0.0.1 and more Source cves: CVE-2026-112943 Source advisory: OSV:GHSA-698V-4R3X-3VCV...

3nit-utils (>=0.24.0, <=1.0.2), 6ix (0.0.0-canary.0) +317 more potentially affected by CVE-2026-112943 via launch-editor (>=2.2.1, <=2.14.1)

launch-editor NPM version =2.2.1, =0.24.0, =0.0.0-canary.0, =0.0.1, =7.0.2, =1.0.0, =0.4.0, =0.1.0, =0.3.0, =1.0.0, =0.2.0, =0.2.10 - @carnesen/www 0.1.0 - @catapult-tech/cp-design-system-site 1.0.0 - @caviar/cli 0.0.1 and more Source cves: CVE-2026-112943 Source advisory:...

GHSA-698V-4R3X-3VCV launch-editor: escapeCmdArgs() omits % escaping on Windows

Summary launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. Impact Only apps that match all of the following conditions are affected: - The user uses Windows - An...

Electron input validation vulnerability

Versions of Electron prior to 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5 contain a vulnerability related to input validation errors. This vulnerability arises from requests for external protocol URLs being assigned to documents other than those that initiated the request. As a result, the...

CVE-2026-112942

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved whil...

CVE-2026-112944

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative...

CVE-2026-112943

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This...