launch-editor Path Traversal Vulnerability on Windows

Executive Summary

This vulnerability affects the launch-editor package on Windows systems. It fails to escape the percent sign (%) when passing arguments to cmd.exe. Attackers can exploit this by manipulating environment variables or filenames containing special characters like %, leading to command injection attacks.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses vulnerable versions of launch-editor, vite, or vite-plus. Inspect environment variables for suspicious values containing % or ^. Review file paths for unusual characters. Use commands like 'npm list launch-editor' or 'npm list vite' to check installed versions.

Useful 0 Not Useful 0

Impact Analysis

If you use affected versions of launch-editor on Windows, an attacker could execute arbitrary commands on your system. This requires the attacker to control environment variables or create files with malicious names containing % or other special characters.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily affects Windows systems by allowing command injection through improper handling of percent signs in file paths. While it does not directly impact GDPR or HIPAA compliance, it could indirectly affect compliance if exploited to access or modify sensitive data. The vulnerability's limited impact on confidentiality, integrity, and availability (CVSS 6.3) suggests minimal direct regulatory impact.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade launch-editor to version 2.14.2 or later. Avoid using environment variables in file paths. Remove or sanitize any environment variables containing % or ^. Monitor for files with malicious names containing special characters.

Useful 0 Not Useful 0