CVE-2024-52011: Launch editor Launch-editor Vulnerable To Command Injection Vulnerability
HIGHCVE-2024-52011 is a HIGH launch-editor vulnerable to command injection vulnerability (CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')) affecting Launch editor libraries in the npm ecosystem. The issue involves launch-editor vulnerable to command injection via the crafted request on windows. Remediation is available by upgrading affected packages to version 2.9.0, 5.4.9.
CVE-2024-52011 at a Glance
How to Fix CVE-2024-52011
To remediate this vulnerability, upgrade all affected Launch editor dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install launch-editor@2.9.0npm install vite@5.4.9Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls launch-editorHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2024-52011, inspect your project dependencies using npm:
npm ls launch-editorAnalyze the terminal output to locate any version of Launch editor in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.9.0), your application is affected.
Note: The npm ls launch-editor command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), where the product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. In Launch editor, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2024-52011 Affected Launch editor Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
launch-editor
|
npm |
< 2.9.0
|
2.9.0
|
|
vite
|
npm |
< 5.4.9
|
5.4.9
|
References
Frequently Asked Questions
What is CVE-2024-52011?
Which Launch editor versions are affected?
What version fixes CVE-2024-52011?
Is launch-editor affected?
Is vite affected?
What CWE is associated with CVE-2024-52011?
How can I check npm dependencies for CVE-2024-52011?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-c27g-q93r-2cwf",
"modified" : "2026-06-03T18:02:48Z",
"published" : "2026-06-03T18:02:48Z",
"aliases" : [ "CVE-2024-52011" ],
"summary" : "launch-editor vulnerable to command injection via the crafted request on Windows",
"details" : "### Summary\nDue to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters.\n\n### Impact\nIf the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the `launch-editor`:\n\n- An attacker can place a file with the malicious filename\n- An attacker can call the `launchEditor` method with the `file` argument controlled\n- The `launch-editor` package is running on Windows\n\nFor example, some development server using this package satisfy these conditions, as a malicious website might be able to force the downloading of a file and the path of that file is predictable.\n\n### Patch\nThis issue has been fixed in the `launch-editor` version 2.9.0 ([commit](https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e)).",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "launch-editor"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.9.0"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 2.8.2"
}
}, {
"package" : {
"ecosystem" : "npm",
"name" : "vite"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "5.4.9"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 5.4.8"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/vitejs/launch-editor/security/advisories/GHSA-c27g-q93r-2cwf"
}, {
"type" : "WEB",
"url" : "https://github.com/yyx990803/launch-editor/security/advisories/GHSA-c27g-q93r-2cwf"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-52011"
}, {
"type" : "WEB",
"url" : "https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/vitejs/launch-editor"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-77" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-06-03T18:02:48Z",
"nvd_published_at" : "2026-06-01T19:16:18Z"
}
}