Description (CNA)
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| vitejs / launch-editor | affected < 2.9.0 |
| vitejs / vite | affected < 5.4.9 |
CWE
CWE-77
References
- https://github.com/vitejs/launch-editor/security/advisories/GHSA-c27g-q93r-2cwf
- https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in launch-editor, a tool that allows users to open files with line numbers in an editor from Node.js. Due to insufficient sanitization of the `file` argument in the `launchEditor` function, an attacker can execute arbitrary commands on Windows systems by supplying a filename that contains special characters. This can lead to a complete compromise of the affected system.