CVE-2024-52011 launch-editor vulnerable to command injection via the crafted request on Windows
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2024-52011?
CVE-2024-52011 is a high-severity vulnerability in vitejs launch-editor, published on 1 Jun 2026.
Official description
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.
Which versions are affected by CVE-2024-52011?
4 open source packages ship an affected version, including launch-editor and vite.
| Package | Affected | Fixed in |
|---|---|---|
launch-editor npm | All versions | 2.9.0 |
launch-editor npm | All versions | 2.9.0 |
vite npm | All versions | 5.4.9 |
vite npm | All versions | 5.4.9 |
How do I fix CVE-2024-52011?
Upgrade launch-editor to 2.9.0 or later.
Is CVE-2024-52011 being exploited?
There is no known exploitation of CVE-2024-52011 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as CLEANSTART-2026-BL91899, CLEANSTART-2026-XZ43182, CLSA-2026-1789376303, CLSA-2026-1792225955, GHSA-c27g-q93r-2cwf, MINI-h95m-c6j6-7m2w and 1 more.