https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 00:20:56 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-112943 <p>launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.</p> <p>launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.</p> https://db.gcve.eu/vuln/fkie_cve-2026-112943 https://db.gcve.eu/vuln/ghsa-698v-4r3x-3vcv <p><strong>Affected:</strong> npm: launch-editor, npm: vite, npm: vite-plus</p> <p>### Summary</p> <p>`launch-editor` did not escape `%` on Windows when passing an argument to `cmd`. When an environment variable contained a malicious value, it was possible that that content to be executed.</p> <p>### Impact</p> <p>Only apps that match all of the following conditions are affected:</p> <p>- The user uses Windows - An attacker can place a file with the malicious filename containing `&amp;` or `%` - Either of - An attacker can inject an environment variable with a malicious value - An attacker can add a NTFS alternate data stream to the file placed</p> <p>### Details</p> <p>Unlike `.sh` files, `.bat` / `.cmd` files on Windows cannot be called directly using [`child_process.spawn`](https://nodejs.org/docs/latest-v24.x/api/child_process.html#child_processspawncommand-args-options) and requires passing them as an argument of `cmd.exe`. To do so, launch-editor escapes the arguments passed to `cmd.exe`. But `launch-editor` did not escape `%` which is used for environment variables.</p> <p>Because `launch-editor` checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.</p> <p>- If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set ` &amp;calc.exe ` to `%ENV%`) and call `launchEditor` with `something%ENV%`. - If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named `~-38%calc.exe`), they can call `launchEditor` with `something %CMDCMDLINE:~-38%c…</p> <p><strong>Affected:</strong> npm: launch-editor, npm: vite, npm: vite-plus</p> <p>### Summary</p> <p>`launch-editor` did not escape `%` on Windows when passing an argument to `cmd`. When an environment variable contained a malicious value, it was possible that that content to be executed.</p> <p>### Impact</p> <p>Only apps that match all of the following conditions are affected:</p> <p>- The user uses Windows - An attacker can place a file with the malicious filename containing `&amp;` or `%` - Either of - An attacker can inject an environment variable with a malicious value - An attacker can add a NTFS alternate data stream to the file placed</p> <p>### Details</p> <p>Unlike `.sh` files, `.bat` / `.cmd` files on Windows cannot be called directly using [`child_process.spawn`](https://nodejs.org/docs/latest-v24.x/api/child_process.html#child_processspawncommand-args-options) and requires passing them as an argument of `cmd.exe`. To do so, launch-editor escapes the arguments passed to `cmd.exe`. But `launch-editor` did not escape `%` which is used for environment variables.</p> <p>Because `launch-editor` checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.</p> <p>- If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set ` &amp;calc.exe ` to `%ENV%`) and call `launchEditor` with `something%ENV%`. - If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named `~-38%calc.exe`), they can call `launchEditor` with `something %CMDCMDLINE:~-38%c…</p> https://db.gcve.eu/vuln/ghsa-698v-4r3x-3vcv