The launch-editor NPM package allows the access of arbitrary paths, including Windows UNC (Universal Naming Convention) paths. On Windows systems, accessing a UNC path triggers an automatic NTLM (New Technology LAN Manager) authentication attempt to the remote SMB (Server Message Block) server without requiring user interaction. If an attacker controls the remote SMB server, the user's NTLMv2 password hash is leaked, which can then be subjected to offline hash cracking to reveal the cleartext password. This issue can be triggered via the `file` parameter in the `/ open-in-editor` endpoint.