Skip to content
fr Sign in
7.5 High

CVE-2024-52011 launch-editor allows users to open files with line numbers in editor from Node.js

Description

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.

Affected products and versions

Product Affected versions Fixed in
launch-editor 2.9 earliest → < 2.9.0 2.9.0
vite 5.4 earliest → < 5.4.9 5.4.9
Cryostat 4 Versions not published
Migration Toolkit for Containers Versions not published
Node HealthCheck Operator Versions not published
OpenShift Lightspeed Versions not published
OpenShift Pipelines Versions not published
OpenShift Service Mesh 2 Versions not published
OpenShift Service Mesh 3 Versions not published
Show the 20 other branches
Product Affected versions Fixed in
Red Hat AMQ Broker 7 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat build of Apache Camel - HawtIO 4 Versions not published
Red Hat Build of Keycloak Versions not published
Red Hat Build of Podman Desktop Versions not published
Red Hat Build of Podman Desktop - Tech Preview Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Developer Hub Versions not published
Red Hat Discovery 2 Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat OpenShift Virtualization 4 Versions not published
Red Hat Quay 3 Versions not published
Self-service automation portal 2 Versions not published
Cluster Observability Operator 1.5.0 1782840539 earliest → < 1782840539 1782840539
Cluster Observability Operator 1.5.2 1782840539 earliest → < 1782840539 1782840539

References

Timeline

  1. Published
  2. Last modified

Other CVEs of launch-editor

The 5 CVEs of launch-editor →
CVE-2026-112944 launch-editor allows users to open files with line numbers in editor from Node.js 6.3 Medium CVE-2026-112943 launch-editor allows users to open files with line numbers in editor from Node.js 6.3 Medium CVE-2026-112942 launch-editor allows users to open files with line numbers in editor from Node.js 7.5 High CVE-2026-53632 launch-editor allows users to open files with line numbers in editor from Node.js 5.5 Medium
Track this CVE