PT-2026-45495 · Vitejs · Launch-Editor+1

Published 2026-06-01 · Updated 2026-06-01 · CVE-2024-52011

Mitre

CVSS v4.0

7.5

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the launch-editor version 2.9.0, corresponding to vite version 5.4.9.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-52011

Affected Products

Launch-Editor

Vite

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-52011 · Security Note
• https://github.com/vitejs/launch-editor/security/advisories/GHSA-c27g-q93r-2cwf · Note
• https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e · Note