launch-editor (npm)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 2.14.2 or later clears every advisory below that has a fix.

Upgrade commands

npm

npm install launch-editor@2.14.2

yarn

yarn add launch-editor@2.14.2

pnpm

pnpm add launch-editor@2.14.2

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors	Medium EPSS 0.70%	`<= 2.14.1`	No fix yet
GHSA-r825-w8mm-5pxw launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors	Medium EPSS 0.70%	`< 2.14.2`	`2.14.2`
GHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows	Medium EPSS 0.41%	`< 2.14.2`	`2.14.2`
GHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows	Medium EPSS 0.41%	`<= 2.14.1`	No fix yet
GHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows	High EPSS 1.34%	`<= 2.14.1`	No fix yet
GHSA-587h-7wmj-h5pm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows	High EPSS 1.34%	`< 2.14.2`	`2.14.2`
GHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows	Medium EPSS 0.41%	`<= 2.14.0`	No fix yet
GHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows	Medium EPSS 0.41%	`< 2.14.1`	`2.14.1`
GHSA-c27g-q93r-2cwf launch-editor vulnerable to command injection via the crafted request on Windows	High EPSS 0.51%	`< 2.9.0`	`2.9.0`
GHSA-c27g-q93r-2cwf launch-editor vulnerable to command injection via the crafted request on Windows	High EPSS 0.51%	`<= 2.8.2`	No fix yet

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor