GHSA-698v-4r3x-3vcv launch-editor: escapeCmdArgs() omits % escaping on Windows

• npm launch-editor: < 2.14.2 → fixed in 2.14.2 • npm vite: >= 8.3.0, < 8.3.3 → fixed in 8.3.3 • npm vite: >= 8.2.0, < 8.2.4 → fixed in 8.2.4 • npm vite: >= 8.0.0, < 8.1.6 → fixed in 8.1.6 • npm vite: >= 7.0.0, < 7.3.7 → fixed in 7.3.7 • npm vite: < 6.4.4 → fixed in 6.4.4 • npm vite-plus: < 1.1.0 → fixed in 1.1.0

Summary `launch-editor` did not escape `%` on Windows when passing an argument to `cmd`. When an environment variable contained a malicious value, it was possible that that content to be executed. Impact Only apps that match all of the following conditions are affected: • The user uses Windows • An attacker can place a file with the malicious filename containing `&` or `%` • Either of • An attacker can inject an environment variable with a malicious value • An attacker can add a NTFS alternate data stream to the file placed Details Unlike `.sh` files, `.bat` / `.cmd` files on Windows cannot be called directly using `child_process.spawn` and requires passing them as an argument of `cmd.exe`. To do so, launch-editor escapes the arguments passed to `cmd.exe`. But `launch-editor` did not escape `%` which is used for environment variables. Because `launch-editor` checks if the argument matches an existing filename, the attack requires the attacker to be able to place a file. • If the attacker can inject an environment variable as well, they can include the subcommand in the env variable (e.g. set ` &calc.exe ` to `%ENV%`) and call `launchEditor` with `something%ENV%`. • If the attacker can place a NTFS alternate data stream to the file (e.g. a NTFS alternate data stream named `~-38%calc.exe`), they can call `launchEditor` with `something %CMDCMDLINE:~-38%calc.exe`. • If the attacker can create a filename containing the `%CD%` and the subcommand (e.g. `&calc.exe `), they can call `launchEditor` with `./%CD%`