CVE-2026-53632: launch-editor Package NTLMv2 Hash Disclosure via UNC Path Handling on Windows
Summary
CVE-2026-53632: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows. Affects launch-editor versions < 2.14.1. Fixed in 2.14.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The launch-editor package is an NPM tool that allows developers to open files in their preferred code editor directly from the command line or web applications. It is widely used in development environments to streamline the editing process. However, it has a critical vulnerability that allows for NTLMv2 hash disclosure when handling Windows UNC paths, making it susceptible to credential theft.
Vulnerability Detail
The vulnerability arises from the launch-editor package's failure to validate or restrict access to Windows UNC paths. When a UNC path is accessed, Windows automatically attempts NTLM authentication to the specified remote host. This process can inadvertently leak the user's NTLMv2 password hash to an attacker-controlled SMB server without any user interaction or warning. If an attacker knows the URL of the middleware using launch-editor and can direct the user to it, they can capture the NTLMv2 hash and potentially crack the password offline, leading to further compromises.
How To Fix
Latest published version: 2.14.2 as of 23 Oct 2026
npm install launch-editor@2.14.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.14.1
This is the first release that contains the fix.
npm install launch-editor@2.14.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable NTLM authentication on your Windows system. However, this may not be feasible for all users. Alternatively, avoid using the launch-editor package with UNC paths until the package is updated.
Conclusion
The vulnerability identified as CVE-2026-53632 in the launch-editor package poses a significant risk to users on Windows systems due to NTLMv2 hash disclosure via UNC path handling. It is crucial to update the affected packages and implement workarounds to mitigate potential attacks.
See every vulnerability recorded for launch-editor →
FAQ
NTLMv2 hash disclosure refers to the unintended exposure of a user's NTLMv2 password hash, which can be captured by an attacker and used to crack the password offline.
You can check if your application is affected by using the Vulert playground at Vulert Scanner. It analyzes your package-lock.json file for known vulnerabilities.
The primary risk is credential compromise, which can lead to unauthorized access to developer accounts and internal systems, especially if the user's password is weak.
Yes, you can prevent exploitation by updating the affected packages to their patched versions and avoiding the use of UNC paths in your applications.
If immediate updates are not possible, consider disabling NTLM authentication on your Windows system or refrain from using the launch-editor package until it is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for launch-editor.
