CVE-2026-53632 NTLMv2 hash disclosure via UNC path handling on Windows
Attackers can steal NTLMv2 hashes by tricking users into opening UNC paths, enabling offline credential cracking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-53632?
CVE-2026-53632 is a medium-severity vulnerability in vitejs launch-editor, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.
Which versions are affected by CVE-2026-53632?
10 open source packages ship an affected version, including launch-editor, vite and vite-plus.
| Package | Affected | Fixed in |
|---|---|---|
launch-editor npm | All versions | 2.14.1 |
launch-editor npm | All versions | 2.14.1 |
vite npm | All versions | 6.4.3 |
vite npm | All versions | 6.4.3 |
vite npm | From 7.0.0 | 7.3.5 |
vite npm | From 7.0.0 | 7.3.5 |
4 more packages
vite npm | From 8.0.0 | 8.0.16 |
vite npm | From 8.0.0 | 8.0.16 |
vite-plus npm | All versions | 0.1.24 |
vite-plus npm | All versions | 0.1.24 |
How do I fix CVE-2026-53632?
Upgrade launch-editor to 2.14.1 or later.
Is CVE-2026-53632 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53632 exists.
Sources
Also known as CLEANSTART-2026-AX01759, CLEANSTART-2026-VP87405, CLSA-2026-1783991048, CLSA-2026-1788976472, CLSA-2026-1791833577, GHSA-v6wh-96g9-6wx3 and 13 more.