DailyCVE@dailycve
🔵 escapeCmdArgs() omits % escaping on #Windows #CVE-2026-112943 Just Updated -DC-Oct2026-3464 https://dailycve.com/escapecmdargs-omits-escaping-on-windows-cve-2026-112943-just-updated-dc-oct2026-3464/
0000016
245 followersView on X
CVE-2026-112943
LOWCVSS 6.3 · MEDIUMImmediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-78
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE