CVE-2024-52011: launch-editor vulnerable to command injection via the crafted request on Windows
Summary Due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters.
Impact If the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the launch-editor:
- An attacker can place a file with the malicious filename - An attacker can call the launchEditor method with the file argument controlled - The launch-editor package is running on Windows
For example, some development server using this package satisfy these conditions, as a malicious website might be able to force the downloading of a file and the path of that file is predictable.
Patch This issue has been fixed in the launch-editor version 2.9.0 (commit).
Other sources
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the launch-editor version 2.9.0, corresponding to vite version 5.4.9.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/viteto a version that resolves this vulnerability.Fixed in 5.4.9 - Upgrade
Upgrade
npm/launch-editorto a version that resolves this vulnerability.Fixed in 2.9.0 - Upgrade
Upgrade
launch-editorto a version that resolves this vulnerability.Fixed in 2.9.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch vite version 5.4.9
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52011?
CVE-2024-52011 has a high severity rating of 7.5, indicating a serious vulnerability.
How do I fix CVE-2024-52011?
To address CVE-2024-52011, ensure that the `launchEditor` function properly sanitizes the `file` argument to prevent command injection.
What type of vulnerability is CVE-2024-52011?
CVE-2024-52011 is classified as a command injection vulnerability.
What risks are associated with CVE-2024-52011?
The primary risk of CVE-2024-52011 is that it allows an attacker to execute arbitrary commands on Windows systems.
Which software is affected by CVE-2024-52011?
CVE-2024-52011 affects the npm packages `launch-editor` and `vite`.