launch-editor
npm5 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting launch-editorpage 1 of 1
- CVE-2024-52011HIGHCVSS 8.3EG 8.3fixed in 2.9.02026-06-01
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Win…
- CVE-2026-112942HIGHCVSS 7.5EG 7.5fixed in 2.14.22026-10-20
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory componen…
- CVE-2026-112943MEDIUMCVSS 6.3EG 6.3fixed in 2.14.22026-10-20
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was…
- CVE-2026-112944MEDIUMCVSS 6.3EG 6.3fixed in 2.14.22026-10-20
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and t…
- CVE-2026-53632MEDIUMCVSS 5.5EG 5.5fixed in 2.14.12026-06-15
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attemp…
Check whether launch-editor is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for launch-editor CVEs against the assets you own.
Book a Demo →