High [CVE-2026-112943] Arbitrary code execution via improper argument escaping on Windows
This high-severity Red Hat Linux advisory covers CVE-2026-112943.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
Arbitrary code execution via improper argument escaping on Windows. Red Hat rates this important (CVSS 8.1).
Weakness: CWE-78.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 13 hours ago·verify at source
- 2.14.2
Official advisory · high-confidence parse· fetched 13 hours ago·verify at source
Mitigation checklist
- --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to eliminate shell invocation when launching editors on Windows or enforce strict argument allowlists to avoid passing unescaped arguments directly to cmd.exe: upgrade to launch-editor 2.14.2 (or the fixed Grafana/Prometheus builds), which reject arguments containing percent signs, carriage returns, or line feeds by throwing an error instead of passing them to cmd.exe, closing all 4 injection vectors (environment-variable expansion, NTFS alternate data streams, crafted filenames, crafted relative path referencing %CD%). Until patched, this is only a concern on Windows systems running applications that pass user-controlled file paths or arguments to launch-editor — Linux and macOS deployments are unaffected — so restrict and audit who can set environment variables, prohibit placing files containing percent characters, ampersands, or line breaks in working directories, and validate file paths before invoking launch-editor. As a compensating measure, strip carriage returns and line feeds to block command separation and multiline command injection payloads passed into the Windows command shell, deploy Windows Defender Application Control in enforced mode to block unauthorized binaries an injected subcommand might drop, and restrict path characters using allowlist validation to prevent percent signs and line breaks from reaching launch-editor. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper argument escaping defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1307 Command Injection Prevention (No Shell Invocation) (high)
Official advisory · high-confidence parse· fetched 13 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.