CVE-2026-112943

Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.2

Description On Windows, the software fails to escape the % character when passing arguments to cmd.exe. This occurs because .bat or .cmd files cannot be called directly via child process.spawn and must be passed as arguments to the command processor. If an attacker can place a file with a malicious filename containing & or %, and can either inject a malicious environment variable or add an NTFS alternate data stream (a feature of NTFS that allows files to store multiple sets of data), they can execute arbitrary content. For example, an attacker could use a malicious environment variable or a specific filename to trigger the execution of a subcommand.

Recommendations Update launch-editor to version 2.14.2.