{"id":"CVE-2024-52011","published":"2026-06-01T17:17:43Z","modified":"2026-09-04T12:04:46Z","title":"launch-editor vulnerable to command injection via the crafted request on Windows","vendor":"vitejs","product":"launch-editor","tier":"tail","description":{"text":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00514,"percentile":0.43844,"provenance":"source"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"},{"id":"CWE-88","name":"Improper Neutralization of Argument Delimiters in a Command"}],"references":[{"url":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-c27g-q93r-2cwf","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e","tags":["x_refsource_MISC"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-52011","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483853","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-52011.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34342","tags":["vendor-advisory","x_refsource_REDHAT"]}],"priority":{"score":19.0,"factors":[{"name":"EPSS percentile","points":8.77},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":5.25}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-06-09","earliestUrl":"https://github.com/HORKimhab/CVE-2024-52011","repos":[{"name":"HORKimhab/CVE-2024-52011","url":"https://github.com/HORKimhab/CVE-2024-52011","stars":0,"created":"2026-06-09"}]},"first":{"date":"2026-06-09","source":"PoC-in-GitHub","url":"https://github.com/HORKimhab/CVE-2024-52011"},"provenance":"source"},"vendorSlug":"vitejs","affectedVersions":[{"vendor":"vitejs","product":"launch-editor","versions":["< 2.9.0"]},{"vendor":"vitejs","product":"vite","versions":["< 5.4.9"]}],"affected":[{"ecosystem":"npm","package":"launch-editor","vulnerableRanges":["<2.9.0"],"patched":["2.9.0"],"from":["GHSA-c27g-q93r-2cwf"],"provenance":"source"},{"ecosystem":"npm","package":"vite","vulnerableRanges":["<5.4.9"],"patched":["5.4.9"],"from":["GHSA-c27g-q93r-2cwf"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-55605","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-vitejs-launch-editor-cve-2024-52011","children":[{"from":"CVE-2024-52011","to":"CVE-2026-112942","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/launch-editor/index.js"],"commits":["https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e","https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679"],"basis":"shared function","functions":["launchEditor"]}]},{"from":"CVE-2024-52011","to":"CVE-2026-112943","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/launch-editor/index.js"],"commits":["https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e","https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc"],"basis":"shared function","functions":["launchEditor"]}]}],"packageHistory":[{"cve":"CVE-2024-31207","published":"2024-04-04","fixed":"5.2.6","kev":false},{"cve":"CVE-2024-45811","published":"2024-09-17","fixed":"5.4.6","kev":false},{"cve":"CVE-2024-45812","published":"2024-09-17","fixed":"5.4.6","kev":false,"link":{"from":"CVE-2024-45812","to":"CVE-2024-52011","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"5.4.6","toFixed":"5.4.9","daysApart":622}]}},{"cve":"CVE-2024-52011","published":"2026-06-01","fixed":"5.4.9","kev":false},{"cve":"CVE-2025-24010","published":"2025-01-20","fixed":"6.0.9","kev":false},{"cve":"CVE-2025-30208","published":"2025-03-24","fixed":"6.2.3","kev":false},{"cve":"CVE-2025-31125","published":"2025-03-31","fixed":"6.2.4","kev":true},{"cve":"CVE-2026-53632","published":"2026-06-22","fixed":"8.0.16","kev":false,"link":{"from":"CVE-2024-52011","to":"CVE-2026-53632","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:launch-editor","fromFixed":"2.9.0","toFixed":"2.14.1","daysApart":21}]}}],"package":"npm:vite"}}