CVE-2024-52011
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A vulnerability in the launch-editor library (used by Vite) before version 2.9.0 allows arbitrary command execution on Windows. The issue stems from insufficient sanitization of the `file` argument in the `launchEditor` function, enabling an attacker to inject special characters.
Risk Assessment
An attacker can remotely execute arbitrary commands on a Windows server, leading to full system compromise, data theft, or malware installation.
Recommendation
Immediately update the launch-editor library to version 2.9.0 or later, and if using Vite, update to version 5.4.9 or later.
Other vulnerabilities in launch-editor
See all- CVE-2026-112944Medium
launch-editor before 2.14.2 does not force a file path to be interpreted as a positional filename. If an attacker creates a file starting with a plus or minus in the working directory, the selected editor (Vim, gVim, MacVim, Emacs, Emacsclient, Notepad++ with a plugin) treats the attacker-controlled filename as a command-line flag, potentially causing unintended file overwrite or arbitrary command execution.
- CVE-2026-112943Medium
launch-editor before 2.14.2 did not escape % on Windows when passing an argument to cmd. If an environment variable contained a malicious value, that content could be executed.
- CVE-2026-112942High
launch-editor-middleware prior to 2.14.2 mishandles an attacker-controlled Windows file argument ending in a parent-directory component plus a line-and-column suffix. The path is resolved with the suffix present, and the suffix is removed before the existsSync check, bypassing filename existence validation. Combined with a separate Windows percent-expansion flaw, this can lead to OS command injection.
Original NVD description (English source)
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS