5vulnerabilities
- Critical0 (0.0%)
- High2 (40.0%)
- Medium0 (0.0%)
- Moderate3 (60.0%)
- Low0 (0.0%)
launch-editor
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 2HighAffects 2 versions
- 0MediumAffects 0 versions
- 3ModerateAffects 3 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 3 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 2
- Low: 0
- 2 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (5)
Known vulnerabilities affecting launch-editor, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-587h-7wmj-h5pm | High | launch-editor: `fs.existsSync()` existence check can be bypassed on Windows### Summary `launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in `\\..:line:column`. This removes the requirement that the attacker be able to place a file with a malicious filename. Combined with the `%` escaping issue described in [GHSA-698v-4r3x-3vcv](https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv), this bypass can lead to OS command injection when an attacker controls the file argument. ### Impact Only apps that runs on Windows i |
| GitHub (opens in a new tab) | |
| GHSA-698v-4r3x-3vcv | Moderate | launch-editor: escapeCmdArgs() omits % escaping on Windows### Summary `launch-editor` did not escape `%` on Windows when passing an argument to `cmd`. When an environment variable contained a malicious value, it was possible that that content to be executed. ### Impact Only apps that match all of the following conditions are affected: - The user uses Windows - An attacker can place a file with the malicious filename containing `&` or `%` - Either of - An attacker can inject an environment variable with a malicious value - An attacker can add a NTFS alternate data stream to the file placed ### Details Unlike `.sh` files, `.bat` / `.cmd` file |
| GitHub (opens in a new tab) | |
| GHSA-r825-w8mm-5pxw | Moderate | launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors### Summary `launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution. ### Impact #### Direct `launch-editor` users Only apps that match all of the following conditions are affected: - The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory - The user uses or the app specifies any of the following editors: - Vim (including gVim) - MacVim - Emacs |
| GitHub (opens in a new tab) | |
| GHSA-v6wh-96g9-6wx3 | Moderate | launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows### Summary The `launch-editor` NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. ### Impact If the following conditions are met, an attacker can get the NTLMv2 password hash on the computer that is using the `launch-editor`: - using Windows - NTLM is not disabled ([it is recommended to disable](https://techcommunity.m |
| GitHub (opens in a new tab) | |
| GHSA-c27g-q93r-2cwf | High | launch-editor vulnerable to command injection via the crafted request on Windows### Summary Due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. ### Impact If the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the `launch-editor`: - An attacker can place a file with the malicious filename - An attacker can call the `launchEditor` method with the `file` argument controlled - The `launch-editor` package is running on Windows For example, some development server using this pack |
| GitHub (opens in a new tab) |
- GHSA-587h-7wmj-h5pmHighlaunch-editor: `fs.existsSync()` existence check can be bypassed on Windows
< 2.14.2
### Summary `launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in `\\..:line:column`. This removes the requirement that the attacker be able to place a file with a malicious filename. Combined with the `%` escaping issue described in [GHSA-698v-4r3x-3vcv](https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv), this bypass can lead to OS command injection when an attacker controls the file argument. ### Impact Only apps that runs on Windows i
CVE: CVE-2026-112942
- GHSA-698v-4r3x-3vcvModeratelaunch-editor: escapeCmdArgs() omits % escaping on Windows
< 2.14.2
### Summary `launch-editor` did not escape `%` on Windows when passing an argument to `cmd`. When an environment variable contained a malicious value, it was possible that that content to be executed. ### Impact Only apps that match all of the following conditions are affected: - The user uses Windows - An attacker can place a file with the malicious filename containing `&` or `%` - Either of - An attacker can inject an environment variable with a malicious value - An attacker can add a NTFS alternate data stream to the file placed ### Details Unlike `.sh` files, `.bat` / `.cmd` file
CVE: CVE-2026-112943
- GHSA-r825-w8mm-5pxwModeratelaunch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
< 2.14.2
### Summary `launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution. ### Impact #### Direct `launch-editor` users Only apps that match all of the following conditions are affected: - The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory - The user uses or the app specifies any of the following editors: - Vim (including gVim) - MacVim - Emacs
CVE: CVE-2026-112944
- GHSA-v6wh-96g9-6wx3Moderatelaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
< 2.14.1
### Summary The `launch-editor` NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. ### Impact If the following conditions are met, an attacker can get the NTLMv2 password hash on the computer that is using the `launch-editor`: - using Windows - NTLM is not disabled ([it is recommended to disable](https://techcommunity.m
CVE: CVE-2026-53632
- GHSA-c27g-q93r-2cwfHighlaunch-editor vulnerable to command injection via the crafted request on Windows
< 2.9.0
### Summary Due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. ### Impact If the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the `launch-editor`: - An attacker can place a file with the malicious filename - An attacker can call the `launchEditor` method with the `file` argument controlled - The `launch-editor` package is running on Windows For example, some development server using this pack
CVE: CVE-2024-52011