CVE-2026-112943: launch-editor Package Vulnerability Due to Improper % Escaping on Windows
Summary
CVE-2026-112943: launch-editor: escapeCmdArgs() omits % escaping on Windows. Affects launch-editor versions < 2.14.2. Fixed in 2.14.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The launch-editor package is a Node.js utility that facilitates the opening of files in the user's preferred text editor. It is commonly used in various applications to enhance user experience by allowing easy file editing. However, this package has a vulnerability that affects Windows users, particularly when handling command-line arguments that include special characters like '%' and '&'.
Vulnerability Detail
The vulnerability arises from the launch-editor's failure to properly escape '%' characters when passing arguments to cmd.exe on Windows. This oversight can lead to the execution of arbitrary commands if an attacker can manipulate environment variables or place files with malicious names. Specifically, if an attacker can inject an environment variable with a harmful value or create a file with a malicious filename containing '&' or '%', they can exploit this vulnerability to execute unintended commands.
How To Fix
Minimum fixed version
2.14.2
This is the first release that contains the fix.
npm install launch-editor@2.14.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using filenames or environment variables that contain '%' or '&' characters until the package is updated. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The launch-editor package has a significant vulnerability on Windows systems due to improper escaping of '%' characters. Users are advised to update to the latest patched versions to mitigate risks. Until then, applying the recommended workaround can help reduce exposure to potential attacks.
See every vulnerability recorded for launch-editor →
FAQ
The CVSS score of this vulnerability is 6.3, indicating a moderate level of risk.
Only users on Windows systems who use the launch-editor package and have the conditions for exploitation met are affected.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
If immediate updates are not possible, implement the suggested workaround by avoiding the use of special characters in filenames and environment variables.
While the primary risk is the execution of arbitrary commands, it could potentially lead to data loss depending on the commands executed by an attacker.
References
Related vulnerabilities
Recent vulnerabilities recorded for launch-editor.
