CVE-2026-112942: launch-editor Package Vulnerability - Windows Path Bypass Leading to Command Injection
Summary
CVE-2026-112942: launch-editor: fs.existsSync() existence check can be bypassed on Windows. Affects launch-editor versions < 2.14.2. Fixed in 2.14.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The launch-editor package is a tool used in JavaScript applications to open files in an editor directly from the command line. It simplifies the process of editing files by allowing developers to specify line and column numbers. However, this package is vulnerable to a specific issue on Windows systems that can be exploited by attackers.
Vulnerability Detail
The vulnerability arises from the way launch-editor checks for file existence using fs.existsSync(fileName). On Windows, an attacker can bypass this check by crafting a path that ends with '..:line:column'. This manipulation allows the attacker to execute commands without needing to create a malicious file, leading to potential OS command injection. The issue is compounded by a previous vulnerability related to '%' escaping, which can further facilitate exploitation.
How To Fix
Latest published version: 2.14.2 as of 23 Oct 2026
npm install launch-editor@2.14.2The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using paths that could be manipulated to include '..:line:column' when calling the launch-editor. Ensure that user inputs are sanitized and validated to prevent exploitation.
Conclusion
The launch-editor vulnerability (CVE-2026-112942) poses a significant risk to Windows applications by allowing command injection through path manipulation. It is crucial to update the affected packages to their patched versions to mitigate this risk.
See every vulnerability recorded for launch-editor →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Only applications running on Windows are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update the package immediately, ensure that user inputs are sanitized and avoid using potentially exploitable paths.
Yes, Vulert can automate the monitoring of your dependencies for vulnerabilities using just the package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for launch-editor.
