Security Advisory

CVE-2026-53632

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-06-22 15:54:09

Last updated 2026-06-22 17:30:11

Assigner GitHub_M

CVSS score 5.5

State PUBLISHED

Description

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.

← Browse all CVEs View on cve.org ↗