{"id":"CVE-2024-52011","title":"launch-editor allows users to open files with line numbers in editor from Node.js","summary":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on W…","severity":"high","cvss":8.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","cwe":["CWE-77","CWE-88"],"published":"2026-06-01","updated":"2026-08-31","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-52011","references":[{"url":"https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e","label":"security-advisories@github.com"},{"url":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-c27g-q93r-2cwf","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:34342","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2024-52011","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483853","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-52011.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"tags":["nvd","exploit-available"],"epss":0.00514,"epssPercentile":0.42642,"ingestedAt":"2026-08-31T14:09:17.635Z","exploits":{"github":1,"githubRepos":["https://github.com/HORKimhab/CVE-2024-52011"],"checkedAt":"2026-09-21T15:27:41.752Z"},"exploitAvailable":true,"slug":"CVE-2024-52011","body":"## Overview\n\nlaunch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":58,"depthScoreParts":{"impact":45.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":4879,"id":"CVE-2024-52011","ts":1788887213520,"field":"exploit_available","old":"false","new":"true"},{"seq":3762,"id":"CVE-2024-52011","ts":1788886330164,"field":"exploit_available","old":"true","new":"false"},{"seq":2607,"id":"CVE-2024-52011","ts":1788883011271,"field":"exploit_available","old":"false","new":"true"},{"seq":1636,"id":"CVE-2024-52011","ts":1788882411573,"field":"exploit_available","old":"true","new":"false"},{"seq":746,"id":"CVE-2024-52011","ts":1788881849046,"field":"exploit_available","old":"false","new":"true"}]}