Vulnerability Description
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.
Related Weaknesses (CWE)
References
- https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3
- https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3
FAQ
What is CVE-2026-53632?
CVE-2026-53632 is a documented vulnerability. launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path ...
How severe is CVE-2026-53632?
CVSS scoring is not yet available for CVE-2026-53632. Check NVD for updates.
Is there a patch for CVE-2026-53632?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.