CVE-2026-112943 in launch-editorinfo

Summary

by MITRE • 10/20/2026

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsible

GitHub M

Reservation

10/19/2026

Disclosure

10/20/2026

Moderation

accepted

EPSS

0.00000

KEV

no

Activities

low

Sources

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-112943
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-112943
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-112943/

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!