CVE-2024-52011 launch-editor vulnerable to command injection via the crafted request on Windows
HighCVSS 7.5
EPSS 0.51%
- Published
- Updated
- Exploit status
- No public exploit known
Description
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the launch-editor version 2.9.0, corresponding to vite version 5.4.9.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm launch-editor(npm) | <= 2.8.2 | No fix listed |
| npm vite(npm) | <= 5.4.8 | No fix listed |
| redhat/cluster-observability-operator/logging-console-plugin-pf4-rhel9:1782839279(Red Hat:cluster_observability_operator:1.5::el9) | All versions | No fix listed |
| redhat/cluster-observability-operator/logging-console-plugin-pf5-rhel9:1782840539(Red Hat:cluster_observability_operator:1.5::el9) | All versions | No fix listed |
| vitejs launch-editor | = < 2.9.0 | No fix listed |
| vitejs vite | = < 5.4.9 | No fix listed |
| redhat cluster observability operator | < 1782839279 | 1782839279 |
| redhat cluster observability operator | < 1782840539 | 1782840539 |
| redhat cryostat | = 4 | No fix listed |
| redhat rhmt | = 1 | No fix listed |
| redhat workload availability nhc | = 0 | No fix listed |
| redhat openshift lightspeed | All versions | No fix listed |
| redhat openshift pipelines | = 1 | No fix listed |
| redhat service mesh | = 2 | No fix listed |
| redhat service mesh | = 3 | No fix listed |
| redhat amq broker | = 7 | No fix listed |
| redhat ansible automation platform | = 2 | No fix listed |
| redhat apache camel hawtio | = 4 | No fix listed |
| redhat build keycloak | All versions | No fix listed |
| redhat podman desktop | = 1 | No fix listed |
| redhat podman desktop | = 0 | No fix listed |
| redhat jboss data grid | = 8 | No fix listed |
| redhat rhdh | = 1 | No fix listed |
| redhat discovery | = 2 | No fix listed |
| redhat enterprise linux ai | = 3 | No fix listed |
Show 8 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat jboss enterprise application platform | = 8 | No fix listed |
| redhat jbosseapxp | All versions | No fix listed |
| redhat openshift ai | All versions | No fix listed |
| redhat openshift | = 4 | No fix listed |
| redhat openshift devspaces | = 3 | No fix listed |
| redhat container native virtualization | = 4 | No fix listed |
| redhat quay | = 3 | No fix listed |
| redhat ansible portal | = 2 | No fix listed |
References
- https://github.com/vitejs/launch-editor/security/advisories/GHSA-c27g-q93r-2cwf vendor-advisory
- github.com vendor-advisory
- nvd.nist.gov third-party-advisory
- https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e patch
- github.com
- Red Hat CVE page mitigation vdb-entry vendor-advisory
- RHSA-2026:34342 patch vendor-advisory
- Red Hat Bugzilla 2483853 issue-tracking
- www.cve.org
- security.access.redhat.com