CVE-2024-52011
launch-editor vulnerable to command injection via the crafted request on Windows
CVE-2024-52011 is a high vulnerability (CVSS 7.5) in Vitejs Launch-editor, published June 1, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in launch-editor 2.9.0.
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the launch-editor version 2.9.0, corresponding to vite version 5.4.9.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
launch-editor vulnerable to command injection via the crafted request on Windows
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the launch-editor version 2.9.0, corresponding to vite version 5.4.9.
- Record
CVE-2024-52011- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-77, CWE-88
- Updated
- 2026-11-02
EUVDEUVD-2024-55605
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the launch-editor version 2.9.0, corresponding to vite version 5.4.9.
- Record
EUVD-2024-55605- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c27g-q93r-2cwf
launch-editor vulnerable to command injection via the crafted request on Windows
Summary
Due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters.
Impact
If the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the launch-editor:
- An attacker can place a file with the malicious filename
- An attacker can call the
launchEditormethod with thefileargument controlled - The
launch-editorpackage is running on Windows
For example, some development server using this package satisfy these conditions, as a malicious website might be able to force the downloading of a file and the path of that file is predictable.
Patch
This issue has been fixed in the launch-editor version 2.9.0 (commit).
- Record
GHSA-c27g-q93r-2cwf- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-77
- Updated
- 2026-11-02
NVD
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the launch-editor version 2.9.0, corresponding to vite version 5.4.9.
- Record
CVE-2024-52011- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-77, CWE-88
- Updated
- 2026-11-02
OSV
launch-editor vulnerable to command injection via the crafted request on Windows
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the launch-editor version 2.9.0, corresponding to vite version 5.4.9.
- Record
CVE-2024-52011- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-77
- Updated
- 2026-11-02
OSVGHSA-c27g-q93r-2cwf
launch-editor vulnerable to command injection via the crafted request on Windows
Summary
Due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters.
Impact
If the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the launch-editor:
- An attacker can place a file with the malicious filename
- An attacker can call the
launchEditormethod with thefileargument controlled - The
launch-editorpackage is running on Windows
For example, some development server using this package satisfy these conditions, as a malicious website might be able to force the downloading of a file and the path of that file is predictable.
Patch
This issue has been fixed in the launch-editor version 2.9.0 (commit).
- Record
GHSA-c27g-q93r-2cwf- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-77
- Updated
- 2026-11-02
Show 11 moreShow less
OSVCLSA-2026-1784596270 No score
TuxCare security update for vite (3 CVEs)
TuxCare rebuilt vite to address 3 CVEs. Fixed in 4.5.14-tuxcare.3.
- Record
CLSA-2026-1784596270- Updated
- 2026-11-02
OSVCLSA-2026-1786362148 No score
TuxCare security update for vite (3 CVEs)
TuxCare rebuilt vite to address 3 CVEs. Fixed in 4.5.5-tuxcare.9.
- Record
CLSA-2026-1786362148- Updated
- 2026-11-02
OSVCLSA-2026-1789031855 No score
TuxCare security update for vite (16 CVEs)
TuxCare rebuilt vite to address 16 CVEs. Fixed in 4.1.5-tuxcare.1.
- Record
CLSA-2026-1789031855- Updated
- 2026-11-02
OSVCLSA-2026-1789376303 No score
TuxCare security update for vite (1 CVE)
TuxCare rebuilt vite to address 1 CVE. Fixed in 3.2.11-tuxcare.5.
- Record
CLSA-2026-1789376303- Updated
- 2026-11-02
OSVCLSA-2026-1789465375 No score
TuxCare security update for launch-editor (2 CVEs)
TuxCare rebuilt launch-editor to address 2 CVEs. Fixed in 2.2.1-tuxcare.1.
- Record
CLSA-2026-1789465375- Updated
- 2026-11-02
OSVCLSA-2026-1791807914 No score
TuxCare security update for vite (3 CVEs)
TuxCare rebuilt vite to address 3 CVEs. Fixed in 4.5.0-tuxcare.2.
- Record
CLSA-2026-1791807914- Updated
- 2026-11-02
OSVCLSA-2026-1791814956 No score
TuxCare security update for vite (3 CVEs)
TuxCare rebuilt vite to address 3 CVEs. Fixed in 5.0.12-tuxcare.6.
- Record
CLSA-2026-1791814956- Updated
- 2026-11-02
OSVCLSA-2026-1792225953 No score
TuxCare security update for @vitejs/plugin-react (7 CVEs)
TuxCare rebuilt @vitejs/plugin-react to address 7 CVEs. Fixed in 2.9.18-tuxcare.2.
- Record
CLSA-2026-1792225953- Updated
- 2026-11-02
OSVCLSA-2026-1792225955 No score
TuxCare security update for @vitejs/plugin-react (1 CVE)
TuxCare rebuilt @vitejs/plugin-react to address 1 CVE. Fixed in 3.2.11-tuxcare.5.
- Record
CLSA-2026-1792225955- Updated
- 2026-11-02
OSVCLSA-2026-1792761444 No score
TuxCare security update for 3 packages (2 CVEs)
TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 2.9.18-tuxcare.3.
- Record
CLSA-2026-1792761444- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2024-52011 No score
CVE-2024-52011 in launch-editor - Patched by Root
Root has patched CVE-2024-52011 in the launch-editor package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2024-52011- Updated
- 2026-11-02
Affected products
- vitejs launch-editor
- vitejs vite
- red hat cluster observability operator 1.5.0
- red hat cryostat 4
- red hat migration toolkit for containers
- red hat node healthcheck operator
- red hat openshift lightspeed
- red hat openshift pipelines
- red hat openshift service mesh 2
- red hat openshift service mesh 3
- red hat amq broker 7
- red hat ansible automation platform 2
Show 16 moreShow less
- red hat build of apache camel - hawtio 4
- red hat build of keycloak
- red hat build of podman desktop
- red hat build of podman desktop - tech preview
- red hat data grid 8
- red hat developer hub
- red hat discovery 2
- red hat enterprise linux ai (rhel ai) 3
- red hat jboss enterprise application platform 8
- red hat jboss enterprise application platform expansion pack
- red hat openshift ai (rhoai)
- red hat openshift container platform 4
- red hat openshift dev spaces
- red hat openshift virtualization 4
- red hat quay 3
- red hat self-service automation portal 2
Affected packages
| Package | Affected | Fixed |
|---|---|---|
launch-editornpm |
through 2.8.2 | 2.9.0 |
vitenpm |
through 5.4.8 | 5.4.9 |
viteTuxCare:npm |
4.5.14-tuxcare.0 up to 4.5.14-tuxcare.3, plus listed versions 4.5.144.5.14-tuxcare.14.5.14-tuxcare.2 |
4.5.14-tuxcare.3 |
viteTuxCare:npm |
4.5.5-tuxcare.0 up to 4.5.5-tuxcare.9, plus listed versions 4.5.54.5.5-tuxcare.14.5.5-tuxcare.24.5.5-tuxcare.34.5.5-tuxcare.4 Show 4 moreShow less4.5.5-tuxcare.54.5.5-tuxcare.64.5.5-tuxcare.74.5.5-tuxcare.8 |
4.5.5-tuxcare.9 |
viteTuxCare:npm |
4.1.5-tuxcare.0 up to 4.1.5-tuxcare.1, plus listed versions 4.1.5 |
4.1.5-tuxcare.1 |
viteTuxCare:npm |
3.2.11-tuxcare.0 up to 3.2.11-tuxcare.5, plus listed versions 3.2.113.2.11-tuxcare.13.2.11-tuxcare.23.2.11-tuxcare.33.2.11-tuxcare.4 |
3.2.11-tuxcare.5 |
launch-editorTuxCare:npm |
2.2.1-tuxcare.0 up to 2.2.1-tuxcare.1, plus listed versions 2.2.1 |
2.2.1-tuxcare.1 |
viteTuxCare:npm |
4.5.0-tuxcare.0 up to 4.5.0-tuxcare.2, plus listed versions 4.5.04.5.0-tuxcare.1 |
4.5.0-tuxcare.2 |
viteTuxCare:npm |
5.0.12-tuxcare.0 up to 5.0.12-tuxcare.6, plus listed versions 5.0.125.0.12-tuxcare.15.0.12-tuxcare.25.0.12-tuxcare.35.0.12-tuxcare.45.0.12-tuxcare.5 |
5.0.12-tuxcare.6 |
@vitejs/plugin-reactTuxCare:npm |
2.9.18-tuxcare.0 up to 2.9.18-tuxcare.2, plus listed versions 2.9.182.9.18-tuxcare.1 |
2.9.18-tuxcare.2 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
@vitejs/plugin-reactTuxCare:npm |
3.2.11-tuxcare.0 up to 3.2.11-tuxcare.5, plus listed versions 3.2.113.2.11-tuxcare.13.2.11-tuxcare.23.2.11-tuxcare.33.2.11-tuxcare.4 |
3.2.11-tuxcare.5 |
@vitejs/plugin-legacyTuxCare:npm |
2.9.18-tuxcare.0 up to 2.9.18-tuxcare.3, plus listed versions 2.9.182.9.18-tuxcare.12.9.18-tuxcare.2 |
2.9.18-tuxcare.3 |
create-viteTuxCare:npm |
2.9.18-tuxcare.0 up to 2.9.18-tuxcare.3, plus listed versions 2.9.182.9.18-tuxcare.12.9.18-tuxcare.2 |
2.9.18-tuxcare.3 |
viteTuxCare:npm |
2.9.18-tuxcare.0 up to 2.9.18-tuxcare.3, plus listed versions 2.9.182.9.18-tuxcare.12.9.18-tuxcare.2 |
2.9.18-tuxcare.3 |
launch-editornpm |
before 2.9.0 | 2.9.0 |
vitenpm |
before 5.4.9 | 5.4.9 |
launch-editorRoot:npm |
before 2.6.0-aikido.1 | 2.6.0-aikido.1 |
@rootio/launch-editorRoot:npm |
before 2.6.0-root.io.1 | 2.6.0-root.io.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | HORKimhab/CVE-2024-52011 | 2026-06-09 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
References
github.com/vitejs/launch-editor/security/advisories/GHSA-c27g-q93r-2cwf
access.redhat.com/security/cve/CVE-2024-52011
bugzilla.redhat.com/show_bug.cgi?id=2483853
security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-52011.json