Read the docs
TI-2024-34898 Aliases CVE-2024-52011GHSA-c27g-q93r-2cwf

launch-editor vulnerable to command injection via the crafted request on Windows

Priority MEDIUM 41CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-77.

Summary

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00514 44th percentileScored 2026-11-07
Fix Fixed launch-editor (vitejs): 2.9.0vite (vitejs): 5.4.9+2 more productsRed Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vitejslaunch-editorbefore 2.9.02.9.0Patch availableCNA
vitejsvitebefore 5.4.95.4.9Patch availableCNA
—launch-editor (npm)before 2.9.02.9.0Patch availableGHSA-c27g-q93r-2cwf
—vite (npm)before 5.4.95.4.9Patch availableGHSA-c27g-q93r-2cwf
  • launch-editor Vendorvitejs Affected before 2.9.0 Fixed in 2.9.0 Patch available CNA
  • vite Vendorvitejs Affected before 5.4.9 Fixed in 5.4.9 Patch available CNA
  • launch-editor (npm) Vendor— Affected before 2.9.0 Fixed in 2.9.0 Patch available GHSA-c27g-q93r-2cwf
  • vite (npm) Vendor— Affected before 5.4.9 Fixed in 5.4.9 Patch available GHSA-c27g-q93r-2cwf

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:vitejs:vite:*:*:*:*:*:*:*:*——vitejs
  • cpe:2.3:a:vitejs:vite:*:*:*:*:*:*:*:* Versions — — ·vitejs

Remediation

  • Fix · CNA launch-editor (vitejs) Fixed in 2.9.0
  • Fix · CNA vite (vitejs) Fixed in 5.4.9
  • Fix · GHSA-c27g-q93r-2cwf launch-editor (npm) Fixed in 2.9.0 Advisory →
  • Fix · GHSA-c27g-q93r-2cwf vite (npm) Fixed in 5.4.9 Advisory →

Red Hat 1 advisory

  • RHSA-2026:34342 Released 2026-07-01 · Red Hat rating Critical
    Cluster Observability Operator 1.5.0
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9 +9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cluster Observability Operator 1.5Fixed RHSA-2026:34342
Not affected: 27 products
  • Cluster Observability Operator 1.5
  • Cryostat 4
  • Migration Toolkit for Containers
  • Node HealthCheck Operator
  • OpenShift Lightspeed
  • OpenShift Pipelines
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 3
  • Red Hat AMQ Broker 7
  • Red Hat Ansible Automation Platform 2
  • Red Hat Build of Keycloak
  • Red Hat Build of Podman Desktop
  • Red Hat Build of Podman Desktop - Tech Preview
  • Red Hat Data Grid 8
  • Red Hat Developer Hub 1
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Virtualization 4
  • Red Hat Quay 3
  • Red Hat build of Apache Camel - HawtIO 4
  • Self-service automation portal 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-52011
  2. 2026-10-03 Alias added: GHSA-c27g-q93r-2cwf
  3. 2026-10-27 Affected versions changed · Red Hat
  4. 2026-10-30 Affected versions changed · Red Hat
  5. 2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat

References

Advisory 1

Other 4

  • TI-2025-22386 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query KEVCVSS 3.1HIGH 7.5
  • TI-2025-41248 Code injection in vitejs vite-plugin-react CVSS 3.1CRITICAL 9.8
  • TI-2026-28350 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket CVSS 4.0HIGH 8.2
  • TI-2025-41735 @vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development CVSS 3.1HIGH 7.5
  • TI-2025-21544 Vite bypasses server.fs.deny when using `?raw??` CVSS 3.1HIGH 7.5
  • TI-2023-16938 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) CVSS 3.1HIGH 7.5
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences