p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de launch-editor

Vulnerabilidades publicadas para launch-editor en los últimos 30 días: 3. Incluidas en el catálogo KEV: 0.

RSS ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 5

  1. CVE-2026-112944

    Media · CVSS 6.3EPSS 0,7%Corrección disponible

    launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

    launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emac

    launch-editorNode.js
    • Actualiza a 2.14.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-112943

    Media · CVSS 6.3EPSS 0,41%Corrección disponible

    launch-editor: escapeCmdArgs() omits % escaping on Windows

    launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.

    launch-editorNode.js
    • Actualiza a 2.14.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2026-112942

    Alta · CVSS 7.5EPSS 1,33%Corrección disponible

    launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

    launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with

    launch-editorNode.js
    • Actualiza a 2.14.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. CVE-2026-53632

    Media · CVSS 5.5EPSS 0,41%Corrección disponible

    NTLMv2 hash disclosure via UNC path handling on Windows

    launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.

    launch-editorNode.js
    • Actualiza a 2.14.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  5. CVE-2024-52011

    Alta · CVSS 7.5EPSS 0,51%Corrección disponible

    launch-editor vulnerable to command injection via the crafted request on Windows

    launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.

    launch-editorNode.js
    • Actualiza a 2.9.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →