GHSA-587h-7wmj-h5pm: Command Injection

Summary

launch-editor checked fs.existsSync(fileName) before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in \\..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename.

Combined with the % escaping issue described in GHSA-698v-4r3x-3vcv, this bypass can lead to OS command injection when an attacker controls the file argument.

Impact

Only apps that runs on Windows is affected.

Details

The earlier advisory assumed that fs.existsSync() required an attacker-controlled filename to exist. This advisory covers a bypass of that requirement.

A crafted value ending in \\..:1:1 is interpreted differently by launch-editor-middleware, launch-editor, and Windows:

1. launch-editor-middleware calls path.resolve() while the final path component is ..:1:1, so it is not treated as a parent-directory component. 2. launch-editor treats :1:1 as a line-and-column suffix and removes it, leaving a path ending in \\... 3. On Windows, fs.existsSync() accepts the resulting path as the existing parent directory even though the attacker-controlled preceding component does not exist. 4. Because the existence check passes, the crafted filename reaches the Windows shell command.