CVE-2026-53632: launch-editor Information Disclosure Bug

CVE-2026-53632 Overview

CVE-2026-53632 affects the launch-editor NPM package, a utility used to open files in an editor from Node.js with line number support. Versions prior to 2.14.1 accept arbitrary paths without filtering Windows Universal Naming Convention (UNC) paths. When launch-editor opens a UNC path on Windows, the operating system automatically initiates NTLM authentication against the remote Server Message Block (SMB) host. An attacker controlling that SMB server captures the victim's NTLMv2 password hash. Offline cracking of the captured hash can lead to credential compromise. The flaw is categorized as [CWE-73] External Control of File Name or Path.

Critical Impact
Attackers can harvest NTLMv2 hashes from Windows developers using vulnerable versions of launch-editor, enabling offline password cracking and credential theft.

Affected Products

launch-editor NPM package versions prior to 2.14.1
Windows hosts running Node.js applications that depend on launch-editor
Development tooling in the Vite ecosystem that bundles launch-editor

Discovery Timeline

2026-06-22 - CVE-2026-53632 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-53632

Vulnerability Analysis

The launch-editor package exposes functionality that resolves user-supplied file paths and passes them to an editor process. The package does not validate whether the supplied path is a local file or a UNC path of the form \\attacker.example.com\share\file. On Windows, accessing a UNC path triggers an SMB connection to the remote host. The operating system attempts NTLM authentication using the current user's credentials by default. The remote SMB server receives an NTLMv2 challenge-response containing the user's password hash. Attackers can run tools such as Responder or Impacket's smbserver.py to capture this exchange. Captured hashes are then processed offline with hashcat or john to recover plaintext passwords.

Root Cause

The root cause is missing input validation on the file path argument. The package treats any string as a valid local path and delegates resolution to the underlying Windows file APIs. Windows transparently routes UNC paths over SMB, which performs implicit authentication. The launch-editor codebase did not reject or normalize paths beginning with \\ or // prior to version 2.14.1.

Attack Vector

Exploitation requires that an application built on launch-editor accept attacker-influenced input that reaches the editor launch function. Common attack scenarios include a malicious project configuration, a crafted error overlay link in a development server, or a poisoned source map reference. The victim interacts with the editor link, the package opens the UNC path, and the Windows SMB client authenticates to the attacker. User interaction is required, but no privileges on the target system are needed. Refer to the GitHub Security Advisory for additional technical context.

Detection Methods for CVE-2026-53632

Indicators of Compromise

Outbound SMB traffic on TCP port 445 or 139 from developer workstations to unexpected external hosts
Node.js or editor processes (code.exe, notepad++.exe) accessing UNC paths in process command lines
Windows Security Event ID 4624 or 4625 entries showing NTLM authentication attempts to remote shares

Detection Strategies

Inspect Node.js application logs for editor launch invocations containing strings beginning with \\ or //
Hunt for process command lines where launch-editor or its parent applications pass UNC paths as arguments
Correlate child process creation events from node.exe with outbound SMB connections to non-internal IP ranges

Monitoring Recommendations

Block outbound TCP 445 at the perimeter firewall to prevent NTLM hash leakage to external SMB servers
Enable NTLM auditing through Group Policy Network security: Restrict NTLM to log outgoing NTLM traffic
Monitor NPM dependency manifests for launch-editor versions below 2.14.1 in development environments

How to Mitigate CVE-2026-53632

Immediate Actions Required

Upgrade launch-editor to version 2.14.1 or later in all projects and lockfiles
Audit transitive dependencies using npm ls launch-editor to identify nested vulnerable installations
Block outbound SMB traffic from developer workstations to external networks at the firewall layer

Patch Information

The maintainers fixed CVE-2026-53632 in launch-editor version 2.14.1. The patch rejects UNC paths before passing them to the editor invocation logic. Consult the GitHub Security Advisory GHSA-v6wh-96g9-6wx3 for upstream remediation details.

Workarounds

Configure Windows Defender Firewall to block outbound connections on TCP 445 for non-corporate destinations
Set the Group Policy Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers to Deny all
Validate and sanitize file path inputs in applications consuming launch-editor to reject paths starting with \\ or //

bash

# Configuration example
npm install launch-editor@^2.14.1
npm ls launch-editor