npm

launch-editor

Security advisories for launch-editor, newest first. 4 known, all fixed. If you’re on 2.14.2 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

2.14.2

Advisories

4 · 0 unfixed

Last advisory

20 Oct 2026

Safe from

2.14.2

4 advisories · newest first

MODERATE 20 Oct 2026

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

GHSA-r825-w8mm-5pxw · CVE-2026-112944

Affected

< 2.14.2

Fixed in

2.14.2

Published

20 Oct 2026

HIGH 20 Oct 2026

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

GHSA-587h-7wmj-h5pm · CVE-2026-112942

Affected

< 2.14.2

Fixed in

2.14.2

Published

20 Oct 2026

MODERATE 20 Oct 2026

launch-editor: escapeCmdArgs() omits % escaping on Windows

GHSA-698v-4r3x-3vcv · CVE-2026-112943

Affected

< 2.14.2

Fixed in

2.14.2

Published

20 Oct 2026

MODERATE 15 Jun 2026

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

GHSA-v6wh-96g9-6wx3 · CVE-2026-53632

Affected

< 2.14.1

Fixed in

2.14.1

Published

15 Jun 2026

/advisories/npm/launch-editor/feed.rss

From the GitHub advisory database, via OSV · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →