Homepage

launch-editor@2.14.0

launch editor from node.js

  • latest version

    2.14.1

  • latest non vulnerable version

    2.14.1

  • first published

    8 years ago

  • latest version published

    17 days ago

  • licenses detected

  • View launch-editor package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the launch-editor package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    External Control of File Name or Path

    launch-editor is a launch editor from node.js

    Affected versions of this package are vulnerable to External Control of File Name or Path in the handling of UNC paths on Windows systems. An attacker can obtain NTLMv2 password hashes by tricking a user into accessing a malicious SMB server through a specially crafted UNC path.

    Note:

    This is only exploitable if the system is running Windows, NTLM authentication is enabled, the user accesses a malicious website that interacts with a middleware using the affected package, the server with the middleware is running, and the attacker knows the URL for that server and middleware.

    How to fix External Control of File Name or Path?

    Upgrade launch-editor to version 2.14.1 or higher.

    <2.14.1
    Go back to all versions of this package