CVE-2026-53632

Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.1

Description The launch-editor NPM package allows the access of arbitrary paths, including Windows UNC (Universal Naming Convention) paths. On Windows systems, accessing a UNC path triggers an automatic NTLM (New Technology LAN Manager) authentication attempt to the remote SMB (Server Message Block) server without requiring user interaction. If an attacker controls the remote SMB server, the user's NTLMv2 password hash is leaked, which can then be subjected to offline hash cracking to reveal the cleartext password. This issue can be triggered via the file parameter in the / open-in-editor endpoint.

Recommendations Update to version 2.14.1. Disable NTLM to prevent automatic authentication attempts to remote hosts.