CVE-2026-112943

Summary

launch-editor: escapeCmdArgs() omits % escaping on Windows

Severity

medium

EPSS

0.4% (p35)

CWE

CWE-78

Also known as

GHSA-698v-4r3x-3vcv#launch-editor

Published

2026-10-20

Updated

2026-10-20

Advisory details

Summary

launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed.

Impact

Only apps that match all of the following conditions are affected:

• The user uses Windows
• An attacker can place a file with the malicious filename containing & or %
• Either of
  • An attacker can inject an environment variable with a malicious value
  • An attacker can add a NTFS alternate data stream to the file placed

Details

Unlike .sh files, .bat / .cmd files on Windows cannot be called directly using child_process.spawn and requires passing them as an argument of cmd.exe. To do so, launch-editor escapes the arguments passed to cmd.exe. But launch-editor did not escape % which is used for environment variables.

Because launch-editor checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.

• If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set &calc.exe to %ENV%) and call launchEditor with something%ENV%.
• If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named ~-38%calc.exe), they can call launchEditor with something %CMDCMDLINE:~-38%calc.exe.
• If the attacker can create a filename containing the %CD% and the subcommand (e.g. &calc.exe ), they can call launchEditor with ./%CD%

References

• https://github.com/advisories/GHSA-698v-4r3x-3vcv
• https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv
• https://nvd.nist.gov/vuln/detail/CVE-2026-112943
• https://github.com/vitejs/launch-editor/pull/155
• https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc
• https://github.com/vitejs/launch-editor/releases/tag/v2.14.2

Related advisories

• CVE-2026-112942 — high · npm/launch-editor
• CVE-2024-52011 — high · npm/launch-editor
• CVE-2026-112944 — medium · npm/launch-editor
• CVE-2026-53632 — medium · npm/launch-editor
• CVE-2026-112900 — critical · PyPI/Pillow
• CVE-2026-96620 — critical · PyPI/claude-agent-sdk
• CVE-2026-61445 — critical · PyPI/praisonai
• CVE-2026-105697 — critical · PyPI/langflow

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity