# CVE-2024-52011: Vite launch-editor command injection on Windows

Source: https://junglewise.ai/threats/cve-2024-52011-vite-launch-editor-command-injection-on-windows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2024-52011 · Severity: high · CVSS 4 · Published 2026-06-01

A vulnerability in the launch-editor library, commonly used in web development tools like Vite, allows attackers to execute unauthorized commands on a developer's Windows computer. This occurs when the tool is tricked into opening a file with a specially crafted name containing malicious characters. If exploited, an attacker could gain full control over the affected workstation, potentially leading to data theft or further network intrusion.

Technologies: [launch-editor (npm)](https://junglewise.ai/threats/technologies/npm-launch-editor), [Vite Launch-Editor](https://junglewise.ai/threats/technologies/launch-editor), [Vite](https://junglewise.ai/threats/technologies/vite), [Vite](https://junglewise.ai/threats/technologies/npm-vite). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Vite](https://junglewise.ai/threats/vendors/vite).

## Quick answers

**Is CVE-2024-52011 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-52011 being exploited in the wild.

**How severe is CVE-2024-52011?** High severity, with a CVSS score of 4, published 1 June 2026.

**Which products and versions are affected?** launch-editor (npm) SEMVER:introduced=0,fixed=2.9.0; Vite Launch-Editor <= 2.8.2; Vite <= 2.8.2; Vite SEMVER:introduced=0,fixed=5.4.9.

**Is there a fix for CVE-2024-52011?** Yes. launch-editor (npm): upgrade to 2.9.0 or later; Vite: upgrade to 5.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-52011 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-52011?** Check whether you run launch-editor (npm), Vite Launch-Editor, Vite or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- launch-editor (npm): upgrade to 2.9.0 or later

  ```sh
  npm install launch-editor@2.9.0
  ```

- Vite: upgrade to 5.4.9 or later

## Technical details

A command injection vulnerability (CWE-77) exists in the launch-editor npm package when running on Windows. The root cause is insufficient sanitization of the 'file' argument within the launchEditor function, which allows special characters to break out of the intended command context. To exploit this, an attacker must be able to place a file with a malicious name on the target system and trigger the launchEditor method with that filename. This is particularly relevant for development servers where a malicious website might force a file download to a predictable path and then trigger the editor. The issue is fixed in launch-editor version 2.9.0 and Vite version 5.4.9.

## Affected products

- vitejs launch-editor <= 2.8.2
- vitejs vite <= 5.4.8

## Identifiers

- CVE-2024-52011
- GHSA-c27g-q93r-2cwf

## Timeline

- 2026-06-01: disclosed
- 2026-06-01: patched
- 2026-06-03: advisory

## References

- [https://api.github.com/users/Ry0taK](https://api.github.com/users/Ry0taK)
- [https://github.com/Ry0taK](https://github.com/Ry0taK)
- [https://api.github.com/users/Ry0taK/gists%7B/gist_id%7D](https://api.github.com/users/Ry0taK/gists%7B/gist_id%7D)
- [https://api.github.com/users/Ry0taK/repos](https://api.github.com/users/Ry0taK/repos)
- [https://avatars.githubusercontent.com/u/49341894?v=4](https://avatars.githubusercontent.com/u/49341894?v=4)
- [https://api.github.com/users/Ry0taK/events%7B/privacy%7D](https://api.github.com/users/Ry0taK/events%7B/privacy%7D)

## Related threats

- [Vite development server file access bypass via query parameters](https://junglewise.ai/threats/cve-2026-118662-vite-is-a-frontend-tooling-framework-for-javascript-from-6-4-4)
- [Vite information disclosure via WebAssembly query parameter](https://junglewise.ai/threats/cve-2026-112947-vite-is-a-frontend-tooling-framework-for-javascript-from-8-2-0)
- [Vite import analysis filesystem disclosure](https://junglewise.ai/threats/cve-2026-112946-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)
- [Vite path traversal in transformIndexHtml](https://junglewise.ai/threats/cve-2026-112945-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)
- [launch-editor command injection in editor invocation](https://junglewise.ai/threats/cve-2026-112944-launch-editor-allows-users-to-open-files-with-line-numbers-in)