What’s Vulnerable › Vulnerabilities

CVE-2026-53632: NTLMv2 hash disclosure via UNC path handling on Windows

• Severity: medium (CVSS 5.5 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-22 · updated 2026-06-23
• Weakness: CWE-73

Description

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.

Affected products

• vitejs launch-editor: before 2.14.1
• vitejs vite: from 8.0.0, < 8.0.16; from 7.0.0, < 7.3.5; before 6.4.3
• vitejs vite-plus: before 0.1.24

References

• https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3
• https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3

Get alerted when CVE-2026-53632 or the next vulnerability affects your stack