PT-2026-120301 · Npm · Launch-Editor+2

تاريخ النشر

2026-10-20

·

تاريخ التحديث

2026-10-20

CVSS v4.0

6.3

متوسطة

المتجهAV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Summary

launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed.

Impact

Only apps that match all of the following conditions are affected:
  • The user uses Windows
  • An attacker can place a file with the malicious filename containing & or %
  • Either of
  • An attacker can inject an environment variable with a malicious value
  • An attacker can add a NTFS alternate data stream to the file placed

Details

Unlike .sh files, .bat / .cmd files on Windows cannot be called directly using [child process.spawn](https://nodejs.org/docs/latest-v24.x/api/child process.html#child processspawncommand-args-options) and requires passing them as an argument of cmd.exe. To do so, launch-editor escapes the arguments passed to cmd.exe. But launch-editor did not escape % which is used for environment variables.
Because launch-editor checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file.
  • If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set &calc.exe to %ENV%) and call launchEditor with something%ENV%.
  • If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named ~-38%calc.exe), they can call launchEditor with something %CMDCMDLINE:~-38%calc.exe.
  • If the attacker can create a filename containing the %CD% and the subcommand (e.g. &calc.exe ), they can call launchEditor with ./%CD%

إصلاح

OS Command Injection

وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
dbugs@ptsecurity.com

تصنيف نقاط الضعف

CWE-78

المعرّفات ذات الصلة

GHSA-698V-4R3X-3VCV

المنتجات المتأثرة

Launch-Editor
Vite
Vite-Plus