launch-editor: escapeCmdArgs() omits % escaping on Windows

影響: npm:launch-editor <= 2.14.1 → 2.14.2, npm:vite >= 8.3.0, <= 8.3.2 → 8.3.3, npm:vite >= 8.2.0, <= 8.2.3 → 8.2.4, npm:vite >= 8.0.0, <= 8.1.5 → 8.1.6, npm:vite >= 7.0.0, <= 7.3.6 → 7.3.7, npm:vite <= 6.4.3 → 6.4.4, npm:vite-plus <= 1.0.0 → 1.1.0

launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. Impact Only apps that match all of the following conditions are affected: - The user uses Windows - An attacker can place a file with the malicious filename containing & or % - Either of - An attacker can inject an environment variable with a malicious value - An attacker can add a NTFS alternate data strea…

GitHub Advisory Database에서 읽기

2026. 10. 21. 오전 03:30, GitHub Advisory Database에서 "launch-editor: escapeCmdArgs() omits % escaping on Windows"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-112943.