Most recent entries from all

BREW-vite-CVE-2024-52011 — launch-editor vulnerable to command injection via the crafted request on Windows

Affected: Homebrew: vite

### Summary Due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters.

### Impact If the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the `launch-editor`:

- An attacker can place a file with the malicious filename - An attacker can call the `launchEditor` method with the `file` argument controlled - The `launch-editor` package is running on Windows

For example, some development server using this package satisfy these conditions, as a malicious website might be able to force the downloading of a file and the path of that file is predictable.

### Patch This issue has been fixed in the `launch-editor` version 2.9.0 ([commit](https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e)).

CLEANSTART-2026-BL91899 — Security fix for CVE-2024-52011 applied in: argo-workflows 3.6.19-r7, argo-workflows 3.7.15-r3

Affected: CleanStart: argo-workflows

CVE-2024-52011 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-363704

fkie_cve-2024-52011

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.

GHSA-c27g-q93r-2cwf — launch-editor vulnerable to command injection via the crafted request on Windows

Affected: npm: launch-editor, npm: vite

### Impact If the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the `launch-editor`:

- An attacker can place a file with the malicious filename - An attacker can call the `launchEditor` method with the `file` argument controlled - The `launch-editor` package is running on Windows

For example, some development server using this package satisfy these conditions, as a malicious website might be able to force the downloading of a file and the path of that file is predictable.

### Patch This issue has been fixed in the `launch-editor` version 2.9.0 ([commit](https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e)).

RHSA-2026:34342 — Red Hat Security Advisory: Cluster Observability Operator 1.5.0

nodejs-trim: Regular Expression Denial of Service (ReDoS) in trim function nodejs-trim-newlines: ReDoS in .end() method braces: fails to limit the number of characters it can handle golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html launch-editor: vite: launch-editor: Arbitrary command execution via insufficient file argument sanitization golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net golang.org/x/net/html: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net golang.org/x/net/html: Quadratic parsing complexity in golang.org/x/net/html golang.org/x/net/html: Infinite parsing loop in golang.org/x/net undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression undici: undici: Denial of Service via crafted WebSocket frame with large length undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter lodash: lodash: Arbitrary code execution via untrusted input in template imports path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri: fast-uri: URI authority bypass due to improper delimiter handlin…