CVE-2024-52011: launch-editor Command Injection Vulnerability on Windows
Summary
CVE-2024-52011: launch-editor vulnerable to command injection via the crafted request on Windows. Affects launch-editor versions < 2.9.0. Fixed in 2.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The launch-editor package is a tool used in development environments to open files in the user's preferred editor. It simplifies the process of launching editors from command-line interfaces or development servers. However, it has been found to be vulnerable to command injection attacks on Windows systems due to insufficient sanitization of user input, specifically the 'file' argument.
Vulnerability Detail
The vulnerability arises from the inadequate sanitization of the 'file' argument in the launchEditor method. An attacker can exploit this by providing a specially crafted filename that includes special characters, allowing them to execute arbitrary commands on the system. This poses a significant risk, especially in scenarios where a malicious file can be placed on the system and the launchEditor method is invoked with a controlled file argument. The impact is severe as it can lead to unauthorized command execution on the affected Windows machine.
How To Fix
Latest published version: 2.14.2 as of 23 Oct 2026
npm install launch-editor@2.14.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.9.0
This is the first release that contains the fix.
npm install launch-editor@2.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the launch-editor package in environments where untrusted input can be passed to the 'file' argument. Implement strict input validation to ensure that filenames do not contain special characters that could lead to command injection.
Conclusion
The launch-editor package has a critical vulnerability (CVE-2024-52011) that allows command injection on Windows systems. It is essential to update to the patched versions to protect against potential exploitation. Users should also consider using Vulert for real-time monitoring of vulnerabilities in their applications.
See every vulnerability recorded for launch-editor →
FAQ
CVE-2024-52011 is a vulnerability in the launch-editor package that allows command injection on Windows systems due to insufficient input sanitization.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can inform you if your application is affected by this vulnerability.
If exploited, this vulnerability can allow attackers to execute arbitrary commands on the affected Windows system, potentially leading to data breaches or system compromise.
Yes, the vulnerability has been patched in launch-editor version 2.9.0 and vite version 5.4.9. It is recommended to update to these versions to mitigate the risk.
If immediate updates are not possible, implement input validation to restrict the use of special characters in filenames and avoid using the launch-editor package in untrusted environments.
References
Related vulnerabilities
Recent vulnerabilities recorded for launch-editor.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
