CVE-2024-52011

Fixed in a distro release EPSS <1%CVSS 7.5

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.

Published 2026-06-01 · CVE record · OSV

Products: vitejs launch-editor, vitejs vite, Red Hat Cluster Observability Operator 1.5.0, Red Hat Cryostat 4, Red Hat Migration Toolkit for Containers, Red Hat Node HealthCheck Operator, Red Hat OpenShift Lightspeed, Red Hat OpenShift Pipelines, Red Hat OpenShift Service Mesh 2, Red Hat OpenShift Service Mesh 3, Red Hat AMQ Broker 7, Red Hat Ansible Automation Platform 2, Red Hat build of Apache Camel - HawtIO 4, Red Hat Build of Keycloak, Red Hat Build of Podman Desktop, Red Hat Build of Podman Desktop - Tech Preview, Red Hat Data Grid 8, Red Hat Developer Hub, Red Hat Discovery 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces, Red Hat OpenShift Virtualization 4, Red Hat Quay 3, Red Hat Self-service automation portal 2

Fixed upstream

Distro releases