launch-editor vulnerable to command injection via the crafted request on Windows
Summary
Due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters.
Impact
If the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the launch-editor:
- An attacker can place a file with the malicious filename
- An attacker can call the
launchEditormethod with thefileargument controlled - The
launch-editorpackage is running on Windows
For example, some development server using this package satisfy these conditions, as a malicious website might be able to force the downloading of a file and the path of that file is predictable.
Patch
This issue has been fixed in the launch-editor version 2.9.0 (commit).
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | launch-editor | < 2.9.0 | 2.9.0 |
| Paquete de npm | vite | < 5.4.9 | 5.4.9 |
Referencias
- https://github.com/vitejs/launch-editor/security/advisories/GHSA-c27g-q93r-2cwf
- https://github.com/yyx990803/launch-editor/security/advisories/GHSA-c27g-q93r-2cwf
- https://nvd.nist.gov/vuln/detail/CVE-2024-52011
- https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e
- https://github.com/vitejs/launch-editor
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N- Debilidad (CWE)
CWE-77- Plataforma
- npm
- Paquete
launch-editor, vite- Publicada
- 03.06.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-c27g-q93r-2cwf - CC BY 4.0
Historial de vulnerabilidades: vite
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 27
- Primera → última
- 08.2022 10.2026
- Sin corrección
- 0
- Explotada en ataques
- 1
Distribución por gravedad
- Alta 8
- Media 16
- Baja 3
Divulgaciones por año
- 2022: 1
- 2023: 2
- 2024: 4
- 2025: 9
- 2026: 11
-
launch-editor vulnerable to command injection via the crafted request on Windows esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.