CVE-2026-53632 Details
Description
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.
A vulnerability in the launch-editor NPM package, affecting versions through 2.14.0, allows arbitrary path access, including Windows UNC paths. When a UNC path is accessed, Windows automatically initiates NTLM authentication to the specified remote host. This process inadvertently leaks the user's NTLMv2 password hash to an attacker-controlled SMB server, potentially leading to credential compromise through offline hash cracking. The vulnerability arises because launch-editor does not validate or restrict UNC path usage, allowing attackers to exploit this behavior and capture NTLMv2 hashes from victims.
Users can update to launch-editor version 2.14.1 or later to address this vulnerability. For projects using Vite, versions 8.0.16, 7.3.5, and 6.4.3 are available. If using Vite Plus, version 0.1.24 should be used.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 22, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| launch-editor | <= 2.14.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |