Affected: vitejs launch-editor, vitejs vite, Red Hat Cluster Observability Operator 1.5.0, Red Hat Cryostat 4, Red Hat Migration Toolkit for Containers, Red Hat Node HealthCheck Operator, Red Hat OpenShift Lightspeed, Red Hat OpenShift Pipelines, Red Hat OpenShift Service Mesh 2, Red Hat OpenShift Service Mesh 3 and 18 more

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.

Affected: npm: launch-editor, npm: vite

### Summary Due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters.

### Impact If the following conditions are met, an attacker can execute arbitrary commands on the computer that is using the `launch-editor`:

- An attacker can place a file with the malicious filename - An attacker can call the `launchEditor` method with the `file` argument controlled - The `launch-editor` package is running on Windows

For example, some development server using this package satisfy these conditions, as a malicious website might be able to force the downloading of a file and the path of that file is predictable.

### Patch This issue has been fixed in the `launch-editor` version 2.9.0 ([commit](https://github.com/vitejs/launch-editor/commit/971291e8a6a91226e1616c5c0ec85423d2d50a5e)).