Packages / vite / Security

HighVulnerabilityGHSA-c27g-q93r-2cwfCVE-2024-52011Published 3 Jun 2026

launch-editor vulnerable to command injection via the crafted request on Windows

Affected releases · vite

  • 5.x5.0.0 – 5.4.8Fixed in 5.4.9
  • 4.x and older0.1.0 – 4.5.14No fix, no longer updated

On 5.x, the newest line:

npm install vite@5.4.9
8.x

  1. Not affected

    8.0.0 – 8.3.5

    34 releases, latest

5.x

  1. Affected

    5.0.0 – 5.4.8

    54 releases

  2. Fixed

    5.4.9 – 5.4.21

    13 releases

4.x

  1. Affected

    4.0.0 – 4.5.14

    53 releases

3.x

  1. Affected

    3.0.0 – 3.2.11

    30 releases

2.x

  1. Affected

    2.0.0 – 2.9.18

    97 releases

0.x

  1. Affected

    0.1.0 – 0.20.10

    78 releases

440 stable releases of vite, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for vite. It is read in your browser and sent nowhere.

What happens

Summary

Due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters.

Impact

If the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the launch-editor:

  • An attacker can place a file with the malicious filename

  • An attacker can call the launchEditor method with the file argument controlled

  • The launch-editor package is running on Windows

For example, some development server using this package satisfy these conditions, as a malicious website might be able to force the downloading of a file and the path of that file is predictable.

Patch

This issue has been fixed in the launch-editor version 2.9.0 (commit).