Vulnerability · Published Jun 22, 2026 · Assigned by GitHub_M

CVE-2026-53632NTLMv2 hash disclosure via UNC path handling on Windows

Medium 5.5

In plain English

A medium-severity security flaw in launch-editor from vitejs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.5Medium

Exploit odds (30 days)0.4%top 64.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	launch-editor	2.14.1	GHSA-v6wh-96g9-6wx3
npm	vite	8.0.16	GHSA-v6wh-96g9-6wx3
npm	vite	7.3.5	GHSA-v6wh-96g9-6wx3
npm	vite	6.4.3	GHSA-v6wh-96g9-6wx3
npm	vite-plus	0.1.24	GHSA-v6wh-96g9-6wx3

Affected products (as reported)

Vendor	Product	Versions
vitejs	launch-editor	< 2.14.1
vitejs	vite	>= 8.0.0, < 8.0.16>= 7.0.0, < 7.3.5< 6.4.3
vitejs	vite-plus	< 0.1.24

Weakness: CWE-73, CWE-522 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

References

https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3 x_refsource_CONFIRM