CVE-2026-53632: Vitejs launch-editor NTLM hash disclosure via UNC path handling

CVE-2026-53632 · Severity: medium · CVSS 4 · Published 2026-06-22

The launch-editor library, commonly used in development tools like Vite to open files in a code editor, contains a flaw that can leak Windows user credentials. If a developer visits a malicious website while their development server is running, the attacker can force the developer's computer to connect to a rogue server. This connection automatically sends the user's encrypted password (NTLMv2 hash), which the attacker can then attempt to crack to gain full access to the developer's account or internal corporate systems.

Technologies: vite-plus (npm), Vite Launch-Editor, Vite. Vendors: npm, Vite.

Quick answers

Is CVE-2026-53632 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53632 being exploited in the wild.
How severe is CVE-2026-53632?
Medium severity, with a CVSS score of 4, published 22 June 2026.
Which products and versions are affected?
vite-plus (npm) <= 0.1.23, SEMVER:introduced=0,fixed=0.1.24; Vite Launch-Editor <= 2.14.0; Vite <= 2.14.0.
Is there a fix for CVE-2026-53632?
Yes. vite-plus (npm): upgrade to 0.1.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53632 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-53632?
Check whether you run vite-plus (npm), Vite Launch-Editor or Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • vite-plus (npm): upgrade to 0.1.24 or later
    npm install vite-plus@0.1.24

Technical details

The launch-editor package prior to version 2.14.1 accepts arbitrary file paths, including Windows Universal Naming Convention (UNC) paths, without proper validation. When a Windows system attempts to access a UNC path (e.g., \\attacker-host\share), the OS automatically initiates NTLM authentication, transmitting the user's NTLMv2 hash to the remote host. An attacker can exploit this by sending a crafted request to a development server's middleware (such as Vite's __open-in-editor endpoint) that uses the vulnerable library. If the attacker controls the destination SMB server, they can capture the hash for offline cracking. This vulnerability is fixed in launch-editor 2.14.1 and corresponding updates for Vite.

Affected products

  • vitejs launch-editor < 2.14.1
  • vitejs vite >= 8.0.0, < 8.0.16; >= 7.0.0, < 7.3.5; < 6.4.3
  • vitejs vite-plus < 0.1.24

Identifiers

  • CVE-2026-53632
  • GHSA-v6wh-96g9-6wx3

Timeline

  • 2026-06-01: advisory: GitHub Security Advisory published
  • 2026-06-22: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.