CVE-2024-52011

Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.9.0 vite versions prior to 5.4.9

Description Insufficient sanitization of the file argument in the launchEditor() function allows an attacker to execute arbitrary commands on Windows systems by providing a filename containing special characters. This can occur if an attacker can place a file with a malicious filename and control the file argument passed to the launchEditor() method, such as through a development server where a malicious website forces the download of a file with a predictable path.

Recommendations Update launch-editor to version 2.9.0 or later. Update vite to version 5.4.9 or later.