{"id":"GHSA-c27g-q93r-2cwf","summary":"launch-editor vulnerable to command injection via the crafted request on Windows","details":"### Summary\nDue to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters.\n\n### Impact\nIf the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the `launch-editor`:\n\n- An attacker can place a file with the malicious filename\n- An attacker can call the `launchEditor` method with the `file` argument controlled\n- The `launch-editor` package is running on Windows\n\nFor example, some development server using this package satisfy these conditions, as a malicious website might be able to force the downloading of a file and the path of that file is predictable.\n\n### Patch\nThis issue has been fixed in the `launch-editor` version 2.9.0 ([commit](https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e)).","aliases":["CVE-2024-52011"],"modified":"2026-07-17T21:08:21.435993503Z","published":"2026-06-03T18:02:48Z","database_specific":{"github_reviewed_at":"2026-06-03T18:02:48Z","nvd_published_at":"2026-06-01T19:16:18Z","cwe_ids":["CWE-77"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-c27g-q93r-2cwf"},{"type":"WEB","url":"https://github.com/yyx990803/launch-editor/security/advisories/GHSA-c27g-q93r-2cwf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52011"},{"type":"WEB","url":"https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e"},{"type":"PACKAGE","url":"https://github.com/vitejs/launch-editor"}],"affected":[{"package":{"name":"launch-editor","ecosystem":"npm","purl":"pkg:npm/launch-editor"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.9.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c27g-q93r-2cwf/GHSA-c27g-q93r-2cwf.json","last_known_affected_version_range":"\u003c= 2.8.2"}},{"package":{"name":"vite","ecosystem":"npm","purl":"pkg:npm/vite"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.4.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c27g-q93r-2cwf/GHSA-c27g-q93r-2cwf.json","last_known_affected_version_range":"\u003c= 5.4.8"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}