CVE-2026-112943
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 20, 2026
Vendor
unknown
Description
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.