Skip to main content
cve.nowby Sazabi
← npm
npmPackage

launch-editor

5 known vulnerabilities (2 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
2.14.2 (Oct 6, 2026): no advisory affects it
Newest unaffected release
2.14.2 (Oct 6, 2026), the latest release
Advisories
5 · 2 high, 3 medium
Weekly downloads
30.5M
Dependents
47K
Releases
24 since 1.0.0 (Jan 6, 2018)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • CVE-2026-112944Medium 6.3

    launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

    Affected: fixed in 2.14.2.

    Fixed in 2.14.2 (released Oct 6, 2026, 14 days before disclosure).

    The latest release, 2.14.2, is not affected.

    67% of launch-editor downloads last week were affected versions (22.9M).

  • CVE-2026-112943Medium 6.3

    launch-editor: escapeCmdArgs() omits % escaping on Windows

    Affected: fixed in 2.14.2.

    Fixed in 2.14.2 (released Oct 6, 2026, 14 days before disclosure).

    The latest release, 2.14.2, is not affected.

    67% of launch-editor downloads last week were affected versions (22.9M).

  • launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

    Affected: fixed in 2.14.2.

    Fixed in 2.14.2 (released Oct 6, 2026, 14 days before disclosure).

    The latest release, 2.14.2, is not affected.

    67% of launch-editor downloads last week were affected versions (22.9M).

  • CVE-2026-53632Medium 5.5

    NTLMv2 hash disclosure via UNC path handling on Windows

    Affected: fixed in 2.14.1.

    Fixed in 2.14.1 (released Jun 1, 2026, 21 days before disclosure).

    The latest release, 2.14.2, is not affected.

    40% of launch-editor downloads last week were affected versions (13.5M).

  • launch-editor vulnerable to command injection via the crafted request on Windows

    Affected: fixed in 2.9.0.

    Fixed in 2.9.0 (released Sep 5, 2024, 634 days before disclosure).

    The latest release, 2.14.2, is not affected.

    8.6% of launch-editor downloads last week were affected versions (2.9M).