PT-2026-120298 · Npm · Launch-Editor+2
Publicado
2026-10-20
·
Atualizado
2026-10-20
CVSS v4.0
7.5
Alta
| Vetor | AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Summary
launch-editor checked fs.existsSync(fileName) before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in ..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename.Combined with the
% escaping issue described in GHSA-698v-4r3x-3vcv, this bypass can lead to OS command injection when an attacker controls the file argument.Impact
Only apps that runs on Windows is affected.
Details
The earlier advisory assumed that
fs.existsSync() required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement.A crafted value ending in
..:1:1 is interpreted differently by launch-editor-middleware, launch-editor, and Windows:launch-editor-middlewarecallspath.resolve()while the final path component is..:1:1, so it is not treated as a parent-directory component.launch-editortreats:1:1as a line-and-column suffix and removes it, leaving a path ending in...- On Windows,
fs.existsSync()accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist. - Because the existence check passes, the crafted filename reaches the Windows shell command.
Correção
Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Launch-Editor
Vite
Vite-Plus