CVE-2024-52011

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 7.5EPSS <1%

Published 2026-06-01Updated 2026-06-09

PoC

Vulnerability details

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CNAGitHub_M

EPSS score history

Sources

3 links

PoC links are not available for guest users. Login to view them.

CVE Organization RedHat Vuln DB GitHub Security Advisories

Profile

CVSS

7.5

EPSS

<1%

Published

2026-06-01

Updated

2026-06-09

CNA

GitHub_M

Vendors

vitejs

2 products

CPEs

cpe:/a:redhat:cryostat:4

cpe:/a:redhat:rhmt:1

cpe:/a:redhat:workload_availability_nhc:0

cpe:/a:redhat:openshift_lightspeed

cpe:/a:redhat:openshift_pipelines:1

cpe:/a:redhat:service_mesh:2

cpe:/a:redhat:service_mesh:3

cpe:/a:redhat:amq_broker:7

cpe:/a:redhat:ansible_automation_platform:2

cpe:/a:redhat:apache_camel_hawtio:4

cpe:/a:redhat:build_keycloak:

cpe:/a:redhat:podman_desktop:1

cpe:/a:redhat:podman_desktop:0

cpe:/a:redhat:jboss_data_grid:8

cpe:/a:redhat:rhdh:1

cpe:/a:redhat:discovery:2::el9

cpe:/a:redhat:enterprise_linux_ai:3

cpe:/a:redhat:jboss_enterprise_application_platform:8

cpe:/a:redhat:jbosseapxp

cpe:/a:redhat:openshift_ai

cpe:/a:redhat:openshift:4

cpe:/a:redhat:openshift_devspaces:3

cpe:/a:redhat:container_native_virtualization:4

cpe:/a:redhat:quay:3

cpe:/a:redhat:ansible_portal:2

cpe:/a:redhat:cluster_observability_operator:1.5::el9

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated