{"id":"CVE-2026-53632","published":"2026-06-22T15:54:09Z","modified":"2026-06-22T17:30:11Z","title":"NTLMv2 hash disclosure via UNC path handling on Windows","vendor":"vitejs","product":"launch-editor","tier":"tail","description":{"text":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.5,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00408,"percentile":0.34995,"provenance":"source"},"cwes":[{"id":"CWE-73","name":"External Control of File Name or Path"},{"id":"CWE-522","name":"Insufficiently Protected Credentials"}],"references":[{"url":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3","tags":["x_refsource_CONFIRM"]}],"priority":{"score":10.8,"factors":[{"name":"EPSS percentile","points":7.0},{"name":"CVSS severity","points":3.85}]},"vendorSlug":"vitejs","affectedVersions":[{"vendor":"vitejs","product":"launch-editor","versions":["< 2.14.1"]},{"vendor":"vitejs","product":"vite","versions":[">= 8.0.0, < 8.0.16",">= 7.0.0, < 7.3.5","< 6.4.3"]},{"vendor":"vitejs","product":"vite-plus","versions":["< 0.1.24"]}],"affected":[{"ecosystem":"npm","package":"launch-editor","vulnerableRanges":["<2.14.1"],"patched":["2.14.1"],"from":["GHSA-v6wh-96g9-6wx3"],"provenance":"source"},{"ecosystem":"npm","package":"vite","vulnerableRanges":[">=8.0.0, <8.0.16",">=7.0.0, <7.3.5","<6.4.3"],"patched":["8.0.16","7.3.5","6.4.3"],"from":["GHSA-v6wh-96g9-6wx3"],"provenance":"source"},{"ecosystem":"npm","package":"vite-plus","vulnerableRanges":["<0.1.24"],"patched":["0.1.24"],"from":["GHSA-v6wh-96g9-6wx3"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-38299","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-52011","published":"2026-06-01","fixed":"5.4.9","kev":false,"link":{"from":"CVE-2024-52011","to":"CVE-2026-53632","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:launch-editor","fromFixed":"2.9.0","toFixed":"2.14.1","daysApart":21}]}},{"cve":"CVE-2026-39363","published":"2026-04-07","fixed":"8.0.5","kev":false,"link":{"from":"CVE-2026-39363","to":"CVE-2026-53632","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"8.0.5","toFixed":"8.0.16","daysApart":76},{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"7.3.2","toFixed":"7.3.5","daysApart":76}]}},{"cve":"CVE-2026-39364","published":"2026-04-07","fixed":"8.0.5","kev":false},{"cve":"CVE-2026-39365","published":"2026-04-07","fixed":"8.0.5","kev":false},{"cve":"CVE-2026-53571","published":"2026-06-22","fixed":"8.0.16","kev":false},{"cve":"CVE-2026-53632","published":"2026-06-22","fixed":"8.0.16","kev":false},{"cve":"CVE-2026-112942","published":"2026-10-20","fixed":"8.3.3","kev":false,"link":{"from":"CVE-2026-53632","to":"CVE-2026-112942","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:launch-editor","fromFixed":"2.14.1","toFixed":"2.14.2","daysApart":120}]}},{"cve":"CVE-2026-112943","published":"2026-10-20","fixed":"8.3.3","kev":false,"link":{"from":"CVE-2026-53632","to":"CVE-2026-112943","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:launch-editor","fromFixed":"2.14.1","toFixed":"2.14.2","daysApart":120}]}},{"cve":"CVE-2026-112944","published":"2026-10-20","fixed":"8.3.3","kev":false,"link":{"from":"CVE-2026-53632","to":"CVE-2026-112944","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:launch-editor","fromFixed":"2.14.1","toFixed":"2.14.2","daysApart":120}]}}],"package":"npm:vite"}}