{"id":"CVE-2024-52011","aliases":["CLSA-2026-1784596270","CLSA-2026-1786362148","CLSA-2026-1789031855","CLSA-2026-1789376303","CLSA-2026-1789465375","CLSA-2026-1791807914","CLSA-2026-1791814956","CLSA-2026-1792225953","CLSA-2026-1792225955","CLSA-2026-1792761444","EUVD-2024-55605","GHSA-c27g-q93r-2cwf","ROOT-APP-NPM-CVE-2024-52011"],"status":"published","title":"launch-editor vulnerable to command injection via the crafted request on Windows","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.","severity":{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00514,"percentile":0.44104,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-77","CWE-88"],"published":"2026-06-01T17:17:43Z","modified":"2026-10-29T19:45:51Z","exploits":[{"source":"pocgithub","id":"HORKimhab/CVE-2024-52011","title":"HORKimhab/CVE-2024-52011","date":"2026-06-09","url":"https://github.com/HORKimhab/CVE-2024-52011"}],"fixes":[{"ecosystem":"npm","package":"launch-editor","fixed_in":["2.9.0"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"vite","fixed_in":["5.4.9"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"vite","fixed_in":["3.2.11-tuxcare.5"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@vitejs/plugin-react","fixed_in":["3.2.11-tuxcare.5"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"launch-editor","fixed_in":["2.6.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/launch-editor","fixed_in":["2.6.0-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"launch-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.8.2"},{"fixed":"2.9.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.4.8"},{"fixed":"5.4.9"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.14-tuxcare.0"},{"fixed":"4.5.14-tuxcare.3"}]}],"versions":["4.5.14","4.5.14-tuxcare.1","4.5.14-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.5-tuxcare.0"},{"fixed":"4.5.5-tuxcare.9"}]}],"versions":["4.5.5","4.5.5-tuxcare.1","4.5.5-tuxcare.2","4.5.5-tuxcare.3","4.5.5-tuxcare.4","4.5.5-tuxcare.5","4.5.5-tuxcare.6","4.5.5-tuxcare.7","4.5.5-tuxcare.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.5-tuxcare.0"},{"fixed":"4.1.5-tuxcare.1"}]}],"versions":["4.1.5"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.11-tuxcare.0"},{"fixed":"3.2.11-tuxcare.5"}]}],"versions":["3.2.11","3.2.11-tuxcare.1","3.2.11-tuxcare.2","3.2.11-tuxcare.3","3.2.11-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"launch-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.1-tuxcare.0"},{"fixed":"2.2.1-tuxcare.1"}]}],"versions":["2.2.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.2"}]}],"versions":["4.5.0","4.5.0-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.12-tuxcare.0"},{"fixed":"5.0.12-tuxcare.6"}]}],"versions":["5.0.12","5.0.12-tuxcare.1","5.0.12-tuxcare.2","5.0.12-tuxcare.3","5.0.12-tuxcare.4","5.0.12-tuxcare.5"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.2"}]}],"versions":["2.9.18","2.9.18-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.11-tuxcare.0"},{"fixed":"3.2.11-tuxcare.5"}]}],"versions":["3.2.11","3.2.11-tuxcare.1","3.2.11-tuxcare.2","3.2.11-tuxcare.3","3.2.11-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.3"}]}],"versions":["2.9.18","2.9.18-tuxcare.1","2.9.18-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.3"}]}],"versions":["2.9.18","2.9.18-tuxcare.1","2.9.18-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.3"}]}],"versions":["2.9.18","2.9.18-tuxcare.1","2.9.18-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"launch-editor","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.9.0"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.4.9"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"launch-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/launch-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-root.io.1"}]}]}],"products":[{"vendor":"red hat","product":"cluster observability operator 1.5.0"},{"vendor":"red hat","product":"cryostat 4"},{"vendor":"red hat","product":"migration toolkit for containers"},{"vendor":"red hat","product":"node healthcheck operator"},{"vendor":"red hat","product":"openshift lightspeed"},{"vendor":"red hat","product":"openshift pipelines"},{"vendor":"red hat","product":"openshift service mesh 2"},{"vendor":"red hat","product":"openshift service mesh 3"},{"vendor":"red hat","product":"red hat amq broker 7"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat build of apache camel - hawtio 4"},{"vendor":"red hat","product":"red hat build of keycloak"},{"vendor":"red hat","product":"red hat build of podman desktop"},{"vendor":"red hat","product":"red hat build of podman desktop - tech preview"},{"vendor":"red hat","product":"red hat data grid 8"},{"vendor":"red hat","product":"red hat developer hub"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift dev spaces"},{"vendor":"red hat","product":"red hat openshift virtualization 4"},{"vendor":"red hat","product":"red hat quay 3"},{"vendor":"red hat","product":"self-service automation portal 2"},{"vendor":"vitejs","product":"launch-editor"},{"vendor":"vitejs","product":"vite"}],"references":[{"url":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-c27g-q93r-2cwf","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e","tags":["x_refsource_MISC","fix","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-52011","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483853","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-52011.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34342","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://github.com/yyx990803/launch-editor/security/advisories/GHSA-c27g-q93r-2cwf","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52011","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c27g-q93r-2cwf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52011.json","tags":["advisory"]},{"url":"https://github.com/vitejs/launch-editor","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-52011","title":"launch-editor vulnerable to command injection via the crafted request on Windows","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.","status":"published","published":"2026-06-01T17:17:43.792Z","modified":"2026-09-04T12:04:46.222Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-77","CWE-88"],"updated_at":"2026-11-02T14:34:03.333404Z"}],"euvd":[{"id":"EUVD-2024-55605","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.","status":"published","published":"2026-06-01T17:17:43Z","modified":"2026-09-04T12:04:46Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:12.73639Z"}],"ghsa":[{"id":"GHSA-c27g-q93r-2cwf","title":"launch-editor vulnerable to command injection via the crafted request on Windows","description":"### Summary\nDue to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters.\n\n### Impact\nIf the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the `launch-editor`:\n\n- An attacker can place a file with the malicious filename\n- An attacker can call the `launchEditor` method with the `file` argument controlled\n- The `launch-editor` package is running on Windows\n\nFor example, some development server using this package satisfy these conditions, as a malicious website might be able to force the downloading of a file and the path of that file is predictable.\n\n### Patch\nThis issue has been fixed in the `launch-editor` version 2.9.0 ([commit](https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e)).","status":"published","published":"2026-06-03T18:02:48Z","modified":"2026-06-03T18:02:48Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:40:16.698699Z"}],"nvd":[{"id":"CVE-2024-52011","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.","status":"published","published":"2026-06-01T19:16:18.977Z","modified":"2026-09-04T13:17:51.61Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-77","CWE-88"],"updated_at":"2026-11-02T14:10:47.77313Z"}],"osv":[{"id":"CVE-2024-52011","title":"launch-editor vulnerable to command injection via the crafted request on Windows","description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.","status":"published","published":"2026-06-01T17:17:43.792Z","modified":"2026-10-28T02:30:21.593016188Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:44:44.032344Z"},{"id":"GHSA-c27g-q93r-2cwf","title":"launch-editor vulnerable to command injection via the crafted request on Windows","description":"### Summary\nDue to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters.\n\n### Impact\nIf the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the `launch-editor`:\n\n- An attacker can place a file with the malicious filename\n- An attacker can call the `launchEditor` method with the `file` argument controlled\n- The `launch-editor` package is running on Windows\n\nFor example, some development server using this package satisfy these conditions, as a malicious website might be able to force the downloading of a file and the path of that file is predictable.\n\n### Patch\nThis issue has been fixed in the `launch-editor` version 2.9.0 ([commit](https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e)).","status":"published","published":"2026-06-03T18:02:48Z","modified":"2026-09-10T03:51:08.326505134Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"CLSA-2026-1784596270","title":"TuxCare security update for vite (3 CVEs)","description":"TuxCare rebuilt vite to address 3 CVEs. Fixed in 4.5.14-tuxcare.3.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-29T19:45:49.540450122Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1786362148","title":"TuxCare security update for vite (3 CVEs)","description":"TuxCare rebuilt vite to address 3 CVEs. Fixed in 4.5.5-tuxcare.9.","status":"published","published":"2026-08-10T11:42:28Z","modified":"2026-10-29T19:45:50.128717503Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1789031855","title":"TuxCare security update for vite (16 CVEs)","description":"TuxCare rebuilt vite to address 16 CVEs. Fixed in 4.1.5-tuxcare.1.","status":"published","published":"2026-09-10T09:17:35Z","modified":"2026-10-15T09:47:55.69239765Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789376303","title":"TuxCare security update for vite (1 CVE)","description":"TuxCare rebuilt vite to address 1 CVE. Fixed in 3.2.11-tuxcare.5.","status":"published","published":"2026-09-14T08:58:23Z","modified":"2026-10-29T19:45:51.354695125Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789465375","title":"TuxCare security update for launch-editor (2 CVEs)","description":"TuxCare rebuilt launch-editor to address 2 CVEs. Fixed in 2.2.1-tuxcare.1.","status":"published","published":"2026-09-15T09:42:55Z","modified":"2026-10-15T09:47:56.137904376Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1791807914","title":"TuxCare security update for vite (3 CVEs)","description":"TuxCare rebuilt vite to address 3 CVEs. Fixed in 4.5.0-tuxcare.2.","status":"published","published":"2026-10-12T12:25:14Z","modified":"2026-10-15T09:47:40.2438322Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791814956","title":"TuxCare security update for vite (3 CVEs)","description":"TuxCare rebuilt vite to address 3 CVEs. Fixed in 5.0.12-tuxcare.6.","status":"published","published":"2026-10-12T14:22:36Z","modified":"2026-10-15T09:47:58.707670391Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792225953","title":"TuxCare security update for @vitejs/plugin-react (7 CVEs)","description":"TuxCare rebuilt @vitejs/plugin-react to address 7 CVEs. Fixed in 2.9.18-tuxcare.2.","status":"published","published":"2026-10-17T08:32:31Z","modified":"2026-10-17T13:09:24.727766679Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792225955","title":"TuxCare security update for @vitejs/plugin-react (1 CVE)","description":"TuxCare rebuilt @vitejs/plugin-react to address 1 CVE. Fixed in 3.2.11-tuxcare.5.","status":"published","published":"2026-10-17T08:32:31Z","modified":"2026-10-17T13:09:24.787053522Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792761444","title":"TuxCare security update for 3 packages (2 CVEs)","description":"TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 2.9.18-tuxcare.3.","status":"published","published":"2026-10-23T13:17:24Z","modified":"2026-10-23T19:15:08.450361484Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"ROOT-APP-NPM-CVE-2024-52011","title":"CVE-2024-52011 in launch-editor - Patched by Root","description":"Root has patched CVE-2024-52011 in the launch-editor package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-09T12:40:00Z","modified":"2026-09-09T13:15:03.242466969Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}