CVE-2026-53632
Fixed in a distro release EPSS <1%CVSS 5.5
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.
Products: vitejs launch-editor, vitejs vite, vitejs vite-plus
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | launch-editor | 2.14.1 |
| npm | vite | 8.0.16 |
| npm | vite | 7.3.5 |
| npm | vite | 6.4.3 |
| npm | vite-plus | 0.1.24 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | arangodb-3.11 | 3.11.14.5-r6 |
| Chainguard | arangodb-3.12 | 3.12.9.4-r19 |
| Chainguard | argo-workflows-ui-3.6 | 3.6.19-r7 |
| Chainguard | commercial-gitlab-rails-ee-19.1 | 19.1.7-r3 |
| Chainguard | commercial-gitlab-rails-ee-19.2 | 19.2.7-r1 |
| Chainguard | commercial-gitlab-rails-ee-19.3 | 19.3.3-r1 |
| Chainguard | commercial-gitlab-rails-ee-19.4 | 19.4.1-r1 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.1 | 19.1.9-r0 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.2 | 19.2.7-r1 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.3 | 19.3.3-r1 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.4 | 19.4.1-r1 |
| Chainguard | gitlab-rails-ce-18.1 | no fix |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.13-r0 |
| Chainguard | gitlab-rails-ce-18.5 | no fix |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.10-r0 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.7-r6 |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.12-r2 |
| Chainguard | gitlab-rails-ce-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r3 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.7-r7 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.1-r1 |
| Chainguard | langfuse-2-worker | 2.95.12-r32 |
| Chainguard | langfuse-fips-2-worker | 2.95.12-r35 |
| Chainguard | nextcloud-server-33 | 33.0.6-r2 |
| Chainguard | nextcloud-server-34 | 34.0.1-r9 |
| Wolfi | nextcloud-server-33 | 33.0.6-r2 |
| openSUSE Leap 16.0 | agama-web-ui | 17+673.b97ba64d6-160000.12.1 |
| openSUSE Tumbleweed | agama-web-ui | 24+0.a836cced5-52.1 |