launch-editor: escapeCmdArgs() omits % escaping on Windows

Overview

Summary

launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed.

Impact

Only apps that match all of the following conditions are affected:

• The user uses Windows
• An attacker can place a file with the malicious filename containing & or %
• Either of
  • An attacker can inject an environment variable with a malicious value
  • An attacker can add a NTFS alternate data stream to the file placed

Details

Unlike .sh files, .bat / .cmd files on Windows cannot be called directly using child_process.spawn and requires passing them as an argument of cmd.exe. To do so, launch-editor escapes the arguments passed to cmd.exe. But launch-editor did not escape % which is used for environment variables.

Because launch-editor checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.

• If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set &calc.exe to %ENV%) and call launchEditor with something%ENV%.
• If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named ~-38%calc.exe), they can call launchEditor with something %CMDCMDLINE:~-38%calc.exe.
• If the attacker can create a filename containing the %CD% and the subcommand (e.g. &calc.exe ), they can call launchEditor with ./%CD%

Affected packages

• launch-editor <= 2.14.1
• vite >= 8.3.0, <= 8.3.2
• vite >= 8.2.0, <= 8.2.3
• vite >= 8.0.0, <= 8.1.5
• vite >= 7.0.0, <= 7.3.6
• vite <= 6.4.3
• vite-plus <= 1.0.0

Remediation

Upgrade to a patched release:

• launch-editor 2.14.2
• vite 8.3.3
• vite 8.2.4
• vite 8.1.6
• vite 7.3.7
• vite 6.4.4
• vite-plus 1.1.0