CVE-2024-52011Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-77CWE-88

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-06-03); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

Patch

150.0%

Classification over time

Date	Total	Labels

2026-06-03	1	Disclosure1
2026-07-23	1	Patch1

Full discourse2 posts

DFIR Lab@DFIR_Lab88d
Patch
🚨 HIGH SEVERITY: CVE-2024-52011 (CVSS 8.3) Command injection in launch-editor npm package affects Node.js/Vite users on Windows. Attackers can execute arbitrary commands via malicious filenames. ✅ Update: launch-editor 2.9.0+ or Vite 5.4.9+ #CVE #Vulnerability #PatchNow https://t.co/o0TgpFq0ot
Post summary
The tweet discloses a high‑severity command injection in the launch-editor NPM package and urges users to upgrade to the patched versions.
0000048
91 followersView on X
Upwind Security MDR@UpwindMDR137d
Disclosure
🚨 High - Vite launch-editor Command Injection on Windows (CVE-2024-52011) The file argument passed to launchEditor is not properly sanitized — a filename containing special characters flows directly into a shell command, enabling arbitrary command execution on Windows. A malicious website can trigger this by forcing a predictable file download and pointing the dev server's editor-open feature at it. No privileges required (CVSS 7.5). 👉 Affected: launch-editor ≤ 2.8.2 / vite ≤ 5.4.8 (Windows only) | Upgrade to launch-editor 2.9.0 / vite 5.4.9
Post summary
The post discloses a command‑injection flaw in Vite’s launch‑editor on Windows, outlines affected versions and impact, and recommends upgrading to patched releases.
0000049
197 followersView on X

Explore more

Back to dashboard