CVE-2026-112942 in launch-editor
Summary
by MITRE • 10/20/2026
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The launch-editor library, a utility designed for Node.js applications to open source files directly into an editor at specific line and column numbers, contained a critical path traversal vulnerability that allowed attackers to bypass file existence checks on Windows systems. This flaw was present in versions prior to 2.14.2 and specifically affected the launch-editor-middleware component which handles user-supplied input for opening files. The core technical issue stems from an inconsistent handling of file paths where the line number suffix is stripped before validating whether the target file exists, creating a window for path manipulation that undermines security controls intended to restrict access to specific resources within the application's directory structure.
The vulnerability operates through a sequence of operations involving string parsing and filesystem validation. When a user provides a filename argument ending with a parent-directory component followed by a line-and-column suffix, such as ../file.js:10, the middleware first resolves this path while the suffix is still attached to determine its canonical location. However, before performing the subsequent existence check using existsSync, the application removes the numeric suffix from the string. This means that instead of checking for the existence of a file at a specific line within a potentially malicious directory traversal path, the system checks only for the existence of the parent directory itself. Since directories are far more likely to exist than arbitrary files in attacker-controlled paths, this logic flaw allows an adversary to pass the validation step even when they do not have permission or ability to access the intended target file.
This bypass mechanism effectively neutralizes a key security control designed to prevent unauthorized file access and potential command injection attacks. By ensuring that only existing directories can satisfy the existence check, attackers can craft payloads that appear valid during verification but resolve to unintended locations during execution. On Windows systems, this vulnerability is particularly dangerous when combined with other known flaws related to percent-expansion in environment variables or path parsing. The combination of these issues enables an attacker to execute arbitrary operating system commands through the editor invocation process, as the application may launch a command-line interface tool pointing to a maliciously crafted location that executes unintended scripts or binaries rather than opening a text file for editing.
From a classification perspective, this vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-835 Loop with Unreachable Exit Condition due to the logic error in suffix removal occurring after path resolution but before validation. In terms of attack vectors, it relates to ATT&CK technique T1059 Command and Scripting Interpreter where an attacker leverages system utilities to execute code. The impact is severe as it allows for remote code execution if the underlying editor or middleware runs with elevated privileges or if the application environment permits arbitrary command invocation through file opening mechanisms.
To mitigate this risk, organizations must immediately upgrade launch-editor and launch-editor-middleware to version 2.14.2 or later where the logic has been corrected to ensure that path validation occurs after all suffixes are removed or handled consistently without exposing directory existence as a proxy for file validity. Additionally, developers should implement strict input sanitization on any user-supplied filenames passed to editor launching functions, ensuring that only absolute paths within expected application directories are accepted. Implementing allowlists for permitted file extensions and validating resolved paths against the base application root can further reduce exposure. Regular security audits of third-party dependencies used in development tools are essential to identify similar logic flaws before they can be exploited in production environments.