High [CVE-2026-112942] Command injection via improper file path validation
This high-severity Red Hat Linux advisory covers CVE-2026-112942.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
Command injection via improper file path validation. Red Hat rates this important (CVSS 8.8).
Weakness: CWE-78.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 13 hours ago·verify at source
- 2.14.2
Official advisory · high-confidence parse· fetched 13 hours ago·verify at source
Mitigation checklist
- --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to eliminate shell invocation when launching editor processes on Windows hosts to prevent percent-variable expansion: upgrade to launch-editor 2.14.2 (or the fixed Grafana/Prometheus builds), which resolve file paths with path.resolve() immediately after stripping line and column position suffixes and check UNC paths on the resolved file name, closing all 3 injection vectors (crafted file path with position suffixes, parent-directory traversal bypass, Windows percent-variable expansion). Until patched, this is only a concern on Windows hosts running launch-editor or launch-editor-middleware endpoints — non-Windows platforms are unaffected — so restrict network access to endpoints exposing launch-editor-middleware and audit file path inputs to block parent-directory sequences and percent characters. As a compensating measure, enforce strict allowlist validation to restrict path characters and reject unexpected percent signs and coordinate suffix formats, deploy a web application firewall to detect and block incoming HTTP requests with traversal patterns or command injection characters, deploy Windows Defender Application Control in enforced mode to block unauthorized binaries an injected subcommand might drop, and configure endpoint detection and response agents to monitor and alert on anomalous child process creation spawned from Node.js. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper path validation defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)
Official advisory · high-confidence parse· fetched 13 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.