launch-editor vulnerabilities
CVEs whose affected-version data names the launch-editor package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-112942High· 7.5launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory compon…
▾ Twilightvitejs · launch-editorEPSS 1.3%via CVEORG
CVE-2026-112943Medium· 6.3launch-editor: escapeCmdArgs() omits % escaping on Windows
launch-editor: escapeCmdArgs() omits % escaping on Windows
▾ Sunlitlaunch-editor · launch-editorEPSS 0.41%via GHSA
CVE-2026-112944Medium· 6.3launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
▾ Sunlitlaunch-editor · launch-editorEPSS 0.70%via GHSA
CVE-2026-53632Mediumlaunch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
▾ Sunlitlaunch-editor · launch-editorEPSS 0.41%via GHSA