CVE-2024-52011 - CVE House

Back to Database

Status published High CVE-2024-52011

launch-editor vulnerable to command injection via the crafted request on Windows

7.5 CVSS

Vulnerability Description

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-52011

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from vitejs

View All →

@vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development

@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server

vite allows server.fs.deny bypass via backslash on Windows

Vite's `server.fs` settings were not applied to HTML files

Vite middleware may serve files starting with the same name with the public directory

Affected Vendor

vitejs

View all reports →

Affected Software

launch-editor, vite

Vulnerable Versions:

< 2.9.0, < 5.4.9

Timeline

Official Publish: June 1st, 2026

Last Modified: July 15th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1105 Ingress Tool Transfer

Command and Control