Описание
launch-editor vulnerable to command injection via the crafted request on Windows
Summary
Due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters.
Impact
If the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the launch-editor:
- An attacker can place a file with the malicious filename
- An attacker can call the
launchEditormethod with thefileargument controlled - The
launch-editorpackage is running on Windows
For example, some development server using this package satisfy these conditions, as a malicious website might be able to force the downloading of a file and the path of that file is predictable.
Patch
This issue has been fixed in the launch-editor version 2.9.0 (commit).
Ссылки
Пакеты
launch-editor
<= 2.8.2
2.9.0
vite
<= 5.4.8
5.4.9
Связанные уязвимости
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.