CVE-2026-112943
Description
A flaw was found in launch-editor. When running on Windows systems, the package fails to properly escape percent characters when passing arguments to the Windows command shell. If an environment variable contains malicious values, an attacker could exploit this behavior to achieve arbitrary code execution on the host system.
Statement
Red Hat has evaluated this vulnerability as having an Important security impact because successful exploitation could allow an attacker to achieve arbitrary command execution within the application context. The defect specifically arises from argument handling when delegating execution to the Windows command shell. Because standard Red Hat environments and containerized distributions operate on Linux systems, typical deployments do not rely on Windows command interpreters and are not directly exposed to this attack vector.
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to eliminate shell invocation when launching editors on Windows or enforce strict argument allowlists to avoid passing unescaped arguments directly to cmd.exe: upgrade to launch-editor 2.14.2 (or the fixed Grafana/Prometheus builds), which reject arguments containing percent signs, carriage returns, or line feeds by throwing an error instead of passing them to cmd.exe, closing all 4 injection vectors (environment-variable expansion, NTFS alternate data streams, crafted filenames, crafted relative path referencing %CD%). Until patched, this is only a concern on Windows systems running applications that pass user-controlled file paths or arguments to launch-editor — Linux and macOS deployments are unaffected — so restrict and audit who can set environment variables, prohibit placing files containing percent characters, ampersands, or line breaks in working directories, and validate file paths before invoking launch-editor. As a compensating measure, strip carriage returns and line feeds to block command separation and multiline command injection payloads passed into the Windows command shell, deploy Windows Defender Application Control in enforced mode to block unauthorized binaries an injected subcommand might drop, and restrict path characters using allowlist validation to prevent percent signs and line breaks from reaching launch-editor. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper argument escaping defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1307 Command Injection Prevention (No Shell Invocation) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
