npm · launch-editor
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.
launch-editor usersOnly apps that match all of the following conditions are affected:
+ or - in the working directorylaunchEditor can start with + or - or the user is using WSLlaunch-editor-middleware usersOnly apps that match the following conditions are affected:
+ or - in the working directoryOnly apps that match the following conditions are affected:
+ or - in the working directorylaunchEditor(file) function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with - (also + for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with + as an Ex command. As a result, an existing relative directory such as:
+call writefile(["SAFE_MARKER"],"LAUNCH_EDITOR_MARKER")|qa!
is not treated as a filename when passed to Vim. Vim executes the embedded Ex command.
The following editor has a potentially destructive operation exposed to the CLI arguments:
launch-editor-middleware v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, launch-editor converts the paths to relative paths internally, so those are still affected.
Vite 2.0.0+ uses launch-editor-middleware v2.2.0+ so the WSL users are only affected.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.