CVE-2026-112942

--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to eliminate shell invocation when launching editor processes on Windows hosts to prevent percent-variable expansion: upgrade to launch-editor 2.14.2 (or the fixed Grafana/Prometheus builds), which resolve file paths with path.resolve() immediately after stripping line and column position suffixes and check UNC paths on the resolved file name, closing all 3 injection vectors (crafted file path with position suffixes, parent-directory traversal bypass, Windows percent-variable expansion). Until patched, this is only a concern on Windows hosts running launch-editor or launch-editor-middleware endpoints — non-Windows platforms are unaffected — so restrict network access to endpoints exposing launch-editor-middleware and audit file path inputs to block parent-directory sequences and percent characters. As a compensating measure, enforce strict allowlist validation to restrict path characters and reject unexpected percent signs and coordinate suffix formats, deploy a web application firewall to detect and block incoming HTTP requests with traversal patterns or command injection characters, deploy Windows Defender Application Control in enforced mode to block unauthorized binaries an injected subcommand might drop, and configure endpoint detection and response agents to monitor and alert on anomalous child process creation spawned from Node.js. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper path validation defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)