CVE-2026-112942

Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.2

Description On Windows, the launch-editor-middleware processes a file argument that can be manipulated to bypass filename existence validation. When a file argument ends with a parent-directory component and a line-and-column suffix (e.g., ..:1:1), the path is resolved while the suffix is present. The launch-editor then removes the suffix before performing an existsSync() check. On Windows, this results in the check validating the existing parent directory rather than the malicious filename. This bypass can lead to OS command injection when combined with a Windows percent-expansion flaw.

Recommendations Update to version 2.14.2.