Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution. Impact Direct launch-editor users Only apps that match all of the following conditions are affected: - The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory - The user uses or the app specifies any of the following editors: - Vim (including gVim) - MacVim - Emacs (including Emacsclient) - Notepad++ (only if using a plugin exposing dangerous operations via plugin messages) - The first argument of launchEditor can start with + or - or the user is using WSL launch-editor-middleware users Only apps that match the following conditions are affected: - The attacker is able to create a file system entry (e.g. a file or directory) starting with + or - in the working directory - The user uses or…
Recommended action: Upgrade to 2.14.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
launch-editor checked fs.existsSync(fileName) before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in \\..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename. Combined with the % escaping issue described in GHSA-698v-4r3x-3vcv, this bypass can lead to OS command injection when an attacker controls the file argument. Impact Only apps that runs on Windows is affected. Details The earlier advisory assumed that fs.existsSync() required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement. A crafted value ending in \\..:1:1 is interpreted differently by launch-editor-middleware, launch-editor, and Windows: 1. launch-editor-middleware calls path.resolve() while the final path component is ..:1:1, so it is not treated as a parent-directory component. 2. launch-editor treats :1:1 as a line-and-column suffix and…
Recommended action: Upgrade to 2.14.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. Impact Only apps that match all of the following conditions are affected: - The user uses Windows - An attacker can place a file with the malicious filename containing & or % - Either of - An attacker can inject an environment variable with a malicious value - An attacker can add a NTFS alternate data stream to the file placed Details Unlike .sh files, .bat / .cmd files on Windows cannot be called directly using childprocess.spawn and requires passing them as an argument of cmd.exe. To do so, launch-editor escapes the arguments passed to cmd.exe. But launch-editor did not escape % which is used for environment variables. Because launch-editor checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file. - If the attacker can inject an…
Recommended action: Upgrade to 2.14.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. Impact If the following conditions are met, an attacker can get the NTLMv2 password hash on the computer that is using the launch-editor: - using Windows - NTLM is not disabled (it is recommended to disable, while it's still enabled by default) - the user accesses the attackers website that sends request to a middleware using launch-editor - the server that has the middleware using launch-editor is running - the attacker knows the URL for that server and the middleware This would be a problem if the user password is too simple that it can be identified through offline hash cracking, potentially leading to further compromise of developer…
Recommended action: Upgrade to 2.14.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. Impact If the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the launch-editor: - An attacker can place a file with the malicious filename - An attacker can call the launchEditor method with the file argument controlled - The launch-editor package is running on Windows For example, some development server using this package satisfy these conditions, as a malicious website might be able to force the downloading of a file and the path of that file is predictable. Patch This issue has been fixed in the launch-editor version 2.9.0 (commit).
Recommended action: Upgrade to 2.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.