Is CVE-2024-52011 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-52011 being exploited in the wild.

How severe is CVE-2024-52011?

High severity, with a CVSS score of 4, published 1 June 2026.

Which products and versions are affected?

launch-editor (npm) SEMVER:introduced=0,fixed=2.9.0; Vite Launch-Editor <= 2.8.2; Vite <= 2.8.2; Vite SEMVER:introduced=0,fixed=5.4.9.

Is there a fix for CVE-2024-52011?

Yes. launch-editor (npm): upgrade to 2.9.0 or later; Vite: upgrade to 5.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-52011 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-52011?

Check whether you run launch-editor (npm), Vite Launch-Editor, Vite or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-52011: Vite launch-editor command injection on Windows

Q: Is there a fix for CVE-2024-52011?

Yes. launch-editor (npm): upgrade to 2.9.0 or later; Vite: upgrade to 5.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-52011 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2024-52011?

Check whether you run launch-editor (npm), Vite Launch-Editor, Vite or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-52011 · Severity: high · CVSS 4 · Published 2026-06-01

A vulnerability in the launch-editor library, commonly used in web development tools like Vite, allows attackers to execute unauthorized commands on a developer's Windows computer. This occurs when the tool is tricked into opening a file with a specially crafted name containing malicious characters. If exploited, an attacker could gain full control over the affected workstation, potentially leading to data theft or further network intrusion.

Technologies: launch-editor (npm), Vite Launch-Editor, Vite, Vite. Vendors: npm, Vite.

Quick answers

Is CVE-2024-52011 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-52011 being exploited in the wild.
How severe is CVE-2024-52011?: High severity, with a CVSS score of 4, published 1 June 2026.
Which products and versions are affected?: launch-editor (npm) SEMVER:introduced=0,fixed=2.9.0; Vite Launch-Editor <= 2.8.2; Vite <= 2.8.2; Vite SEMVER:introduced=0,fixed=5.4.9.
Is there a fix for CVE-2024-52011?: Yes. launch-editor (npm): upgrade to 2.9.0 or later; Vite: upgrade to 5.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-52011 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-52011?: Check whether you run launch-editor (npm), Vite Launch-Editor, Vite or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

launch-editor (npm): upgrade to 2.9.0 or later
```
npm install launch-editor@2.9.0
```
Vite: upgrade to 5.4.9 or later

Technical details

A command injection vulnerability (CWE-77) exists in the launch-editor npm package when running on Windows. The root cause is insufficient sanitization of the 'file' argument within the launchEditor function, which allows special characters to break out of the intended command context. To exploit this, an attacker must be able to place a file with a malicious name on the target system and trigger the launchEditor method with that filename. This is particularly relevant for development servers where a malicious website might force a file download to a predictable path and then trigger the editor. The issue is fixed in launch-editor version 2.9.0 and Vite version 5.4.9.

Affected products

vitejs launch-editor <= 2.8.2
vitejs vite <= 5.4.8

Identifiers

CVE-2024-52011
GHSA-c27g-q93r-2cwf

Timeline

2026-06-01: disclosed
2026-06-01: patched
2026-06-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.