The vitejs launch-editor package before version 2.9.0 contains a command injection vulnerability (CWE-77) due to improper neutralization of special elements in the file argument passed to the launchEditor function. This allows an attacker on Windows systems to execute arbitrary commands by supplying a specially crafted filename containing special characters. The vulnerability has been addressed by sanitizing the input in launch-editor 2.9.0, which is included in vite version 5.4.9. The CVSS 4.0 base score is 7.5, indicating high severity with network attack vector, low attack complexity, partial attack and user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary commands on Windows systems where the vulnerable launch-editor version is used. This can lead to compromise of system integrity, confidentiality, and availability. The vulnerability affects local environments where launch-editor is used to open files with line numbers in editors via Node.js. There are no reports of active exploitation in the wild.

A fix is available by upgrading launch-editor to version 2.9.0 or later, which includes proper sanitization of the file argument to prevent command injection. This fix is also included in vite version 5.4.9. Users should update to these versions to remediate the vulnerability. Since no vendor advisory or patch links were provided, users should verify the update from the official vitejs repository or package manager. No additional mitigations are indicated.