{"id":"CVE-2026-112943","aliases":["GHSA-698v-4r3x-3vcv"],"url":"https://o3.security/vulnerability/CVE-2026-112943","summary":"launch-editor: escapeCmdArgs() omits % escaping on Windows","details":"### Summary\n\n`launch-editor` did not escape `%` on Windows when passing an argument to `cmd`. When an environment variable contained a malicious value, it was possible that that content to be executed.\n\n### Impact\n\nOnly apps that match all of the following conditions are affected:\n\n- The user uses Windows\n- An attacker can place a file with the malicious filename containing `&` or `%`\n- Either of\n  - An attacker can inject an environment variable with a malicious value\n  - An attacker can add a NTFS alternate data stream to the file placed\n\n### Details\n\nUnlike `.sh` files, `.bat` / `.cmd` files on Windows cannot be called directly using [`child_process.spawn`](https://nodejs.org/docs/latest-v24.x/api/child_process.html#child_processspawncommand-args-options) and requires passing them as an argument of `cmd.exe`. To do so, launch-editor escapes the arguments passed to `cmd.exe`. But `launch-editor` did not escape `%` which is used for environment variables.\n\nBecause `launch-editor` checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.\n\n- If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set ` &calc.exe ` to `%ENV%`) and call `launchEditor` with `something%ENV%`.\n- If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named `~-38%calc.exe`), they can call `launchEditor` with `something %CMDCMDLINE:~-38%calc.exe`.\n- If the attacker can create a filename containing the `%CD%` and the subcommand (e.g. `&calc.exe `), they can call `launchEditor` with `./%CD%`","published":"2026-10-20T14:53:41.777Z","modified":"2026-10-24T02:49:39.582657988Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"launch-editor","fixedVersion":"2.14.2"},{"ecosystem":"npm","name":"vite","fixedVersion":"8.3.3"},{"ecosystem":"npm","name":"vite","fixedVersion":"8.2.4"},{"ecosystem":"npm","name":"vite","fixedVersion":"8.1.6"},{"ecosystem":"npm","name":"vite","fixedVersion":"7.3.7"},{"ecosystem":"npm","name":"vite","fixedVersion":"6.4.4"},{"ecosystem":"npm","name":"vite-plus","fixedVersion":"1.1.0"}],"fix":{"url":"https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","label":"vitejs/launch-editor@3c2f9bf"},"references":[{"type":"WEB","url":"https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112943.json"},{"type":"ADVISORY","url":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112943"},{"type":"FIX","url":"https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc"},{"type":"FIX","url":"https://github.com/vitejs/launch-editor/pull/155"},{"type":"PACKAGE","url":"https://github.com/vitejs/launch-editor"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T02:49:39.582657988Z"}}