CVE-2026-112943 — launch-editor: escapeCmdArgs() omits % escaping on Windows
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. Wh…
Published: 2026-10-20 · CVSS: 6.3 · CVSS 4.0
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7