{"id":"CVE-2026-112943","revision":null,"records":[{"revision":"8a6f5a9c1c984c14a2bc4445a64b5902","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-112943","aliases":[],"title":"launch-editor: escapeCmdArgs() omits % escaping on Windows","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.","state":0,"publishedAt":"2026-10-20T14:53:41.777+00:00","modifiedAt":"2026-10-20T15:13:40.862+00:00","affected":[{"ecosystem":"Vendor product","name":"launch-editor","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"vitejs\",\n                    \"product\": \"launch-editor\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.14.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"vite","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"vitejs\",\n                    \"product\": \"vite\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 8.3.0, < 8.3.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 8.2.0, < 8.2.4\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 8.0.0, < 8.1.6\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 7.0.0, < 7.3.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"< 6.4.4\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"vite-plus","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"vitejs\",\n                    \"product\": \"vite-plus\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.1.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","score":6.3,"severity":"MEDIUM"}],"references":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv","https://github.com/vitejs/launch-editor/pull/155","https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112943","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-112943","identifiers":["CVE-2026-112943"]},"retained":false,"historicalAffected":[]},{"revision":"947840e70ee54b4781a4d6a6a9952b8e","observedAt":"2026-11-07T04:33:32.809+00:00","statement":{"source":"euvd","id":"EUVD-2026-105039","aliases":["CVE-2026-112943","GHSA-698v-4r3x-3vcv"],"title":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was …","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","score":6.3,"severity":null}],"references":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv","https://github.com/vitejs/launch-editor/pull/155","https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105039","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 20, 2026, 2:53:41 PM","dateUpdated":"Oct 20, 2026, 3:13:40 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-105039","identifiers":["EUVD-2026-105039","CVE-2026-112943","GHSA-698v-4r3x-3vcv"]},"retained":false,"historicalAffected":[]},{"revision":"c0c843fd0e7a470faace6e0b0df2acea","observedAt":"2026-10-25T05:17:13.11+00:00","statement":{"source":"nvd","id":"CVE-2026-112943","aliases":[],"title":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was …","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.","state":0,"publishedAt":"2026-10-20T15:17:17.643+00:00","modifiedAt":"2026-10-20T19:55:49.343+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.3,"severity":"MEDIUM"}],"references":["https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","https://github.com/vitejs/launch-editor/pull/155","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112943","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-78"],"productCriteria":[],"sourceDates":{"published":"2026-10-20T15:17:17.643","lastModified":"2026-10-20T19:55:49.343"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-112943","identifiers":["CVE-2026-112943"]},"retained":false,"historicalAffected":[]},{"revision":"21f4641471c6436c9f95a5bf05852ed7","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-698v-4r3x-3vcv","aliases":["CVE-2026-112943"],"title":"launch-editor: escapeCmdArgs() omits % escaping on Windows","description":"### Summary\n\n`launch-editor` did not escape `%` on Windows when passing an argument to `cmd`. When an environment variable contained a malicious value, it was possible that that content to be executed.\n\n### Impact\n\nOnly apps that match all of the following conditions are affected:\n\n- The user uses Windows\n- An attacker can place a file with the malicious filename containing `&` or `%`\n- Either of\n  - An attacker can inject an environment variable with a malicious value\n  - An attacker can add a NTFS alternate data stream to the file placed\n\n### Details\n\nUnlike `.sh` files, `.bat` / `.cmd` files on Windows cannot be called directly using [`child_process.spawn`](https://nodejs.org/docs/latest-v24.x/api/child_process.html#child_processspawncommand-args-options) and requires passing them as an argument of `cmd.exe`. To do so, launch-editor escapes the arguments passed to `cmd.exe`. But `launch-editor` did not escape `%` which is used for environment variables.\n\nBecause `launch-editor` checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.\n\n- If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set ` &calc.exe ` to `%ENV%`) and call `launchEditor` with `something%ENV%`.\n- If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named `~-38%calc.exe`), they can call `launchEditor` with `something %CMDCMDLINE:~-38%calc.exe`.\n- If the attacker can create a filename containing the `%CD%` and the subcommand (e.g. `&calc.exe `), they can call `launchEditor` with `./%CD%`","state":0,"publishedAt":"2026-10-20T18:30:24+00:00","modifiedAt":"2026-10-20T18:45:09.4679937+00:00","affected":[{"ecosystem":"npm","name":"launch-editor","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.14.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"vite","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.3.0"},{"kind":"fixed","version":"8.3.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"vite","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.2.0"},{"kind":"fixed","version":"8.2.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"vite","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.0.0"},{"kind":"fixed","version":"8.1.6"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"vite","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"7.0.0"},{"kind":"fixed","version":"7.3.7"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"vite","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"6.4.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"vite-plus","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.1.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv","https://nvd.nist.gov/vuln/detail/CVE-2026-112943","https://github.com/vitejs/launch-editor/pull/155","https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","https://github.com/vitejs/launch-editor","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"sourceUrl":"https://github.com/advisories/GHSA-698v-4r3x-3vcv","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-698v-4r3x-3vcv","identifiers":["GHSA-698v-4r3x-3vcv","CVE-2026-112943"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T12:04:37.5111605+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T12:04:37.5111605+00:00","lastSuccessAt":"2026-11-08T12:04:37.723623+00:00","error":null,"lastVerifiedAt":"2026-11-08T12:04:37.7236261+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-2b67187422a694a3d3288b6a1e28326b3060bb18a3ee01d9be7309c46446a822","complete":true,"records":421097,"lastAttemptAt":"2026-11-08T12:04:36.9953395+00:00","lastSuccessAt":"2026-11-08T12:04:36.9557955+00:00","error":null,"lastVerifiedAt":"2026-11-08T12:04:36.9953395+00:00","snapshotPublishedAt":"2026-11-08T11:26:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-86f25219fb644e6286aef55d85e25bf2","complete":true,"records":13654,"lastAttemptAt":"2026-11-08T12:05:08.2403712+00:00","lastSuccessAt":"2026-11-08T11:08:04.005+00:00","error":null,"lastVerifiedAt":"2026-11-08T11:08:04.005+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T12:04:37.5111605+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T12:04:37.5111605+00:00","lastSuccessAt":"2026-11-08T12:04:37.7247541+00:00","error":null,"lastVerifiedAt":"2026-11-08T12:04:37.7247552+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c8ab24cce7724539b5148423668d4a8d","complete":false,"records":13666,"lastAttemptAt":"2026-11-08T12:05:07.5124328+00:00","lastSuccessAt":"2026-11-08T12:05:07.509+00:00","error":null,"lastVerifiedAt":"2026-11-08T12:05:07.509+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T12:04:37.4138776+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-08T12:04:37.4138776+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T12:04:37.186742+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T12:04:37.186742+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-964c14035e6f0f6478b2870fad6a7ef9f6045876d4a12af2c2e514521e54b6af","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T12:04:37.4417198+00:00","lastSuccessAt":"2026-11-08T11:07:12.1927025+00:00","error":null,"lastVerifiedAt":"2026-11-08T12:04:37.4417198+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f8647d7ba64b1ba0dfdc7130944766d5b36d5b77d18fff0c79e651a4cff3c2b9","complete":true,"records":231293,"lastAttemptAt":"2026-11-08T12:04:37.3024645+00:00","lastSuccessAt":"2026-11-08T11:06:56.2918717+00:00","error":null,"lastVerifiedAt":"2026-11-08T12:04:37.3024645+00:00","snapshotPublishedAt":"2026-11-08T11:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}