CVE-2026-53632 (High) detected in launch-editor-2.2.1.tgz

[mend-bolt-for-github]

CVE-2026-53632 - High Severity Vulnerability

Vulnerable Library - launch-editor-2.2.1.tgz

launch editor from node.js

Library home page: https://registry.npmjs.org/launch-editor/-/launch-editor-2.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/launch-editor/package.json

Dependency Hierarchy:

• nuxt-2.14.3.tgz (Root Library)
  • core-2.14.3.tgz
    • server-2.14.3.tgz
      • launch-editor-middleware-2.2.1.tgz
        • ❌ launch-editor-2.2.1.tgz (Vulnerable Library)

Found in HEAD commit: de1c2b0d1a23367b161c2d995029f9693bd8a155

Found in base branch: master

Vulnerability Details

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.

Publish Date: 2026-06-22

URL: CVE-2026-53632

CVSS 3 Score Details (8.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-06-15

Fix Resolution: https://github.com/vitejs/vite.git - v8.0.16,https://github.com/vitejs/vite.git - v6.4.3,https://github.com/vitejs/launch-editor.git - v2.14.1,https://github.com/vitejs/vite.git - v7.3.5

---

Step up your Open Source Security Game with Mend here