CVE-2026-53632

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.

Score

CVSS 4.0 5.5 Medium

Status

Deferred - security-advisories@github.com

Published

2026-06-22

Last modified

2026-06-22

Weaknesses

CWE-522, CWE-73

Affected products

• Launch-editor (Vitejs)
• Vite (Vitejs)
• Vite-plus (Vitejs)

References

• https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3