NTLMv2 hash disclosure via UNC path handling on Windows
Priority MEDIUM 58CWE-522Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-522.
Summary
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00408 35th percentileScored 2026-11-07
Fix Partial launch-editor (vitejs): 2.14.1vite (vitejs): 8.0.16, 7.3.5, 6.4.3+4 more productsRed Hat: 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vitejs | launch-editor | before 2.14.1 | 2.14.1 | Patch available | CNA |
| vitejs | vite | 8.0.0 to before 8.0.16; 7.0.0 to before 7.3.5; before 6.4.3 | 8.0.16, 7.3.5, 6.4.3 | Patch available | CNA |
| vitejs | vite-plus | before 0.1.24 | 0.1.24 | Patch available | CNA |
| — | launch-editor (npm) | before 2.14.1 | 2.14.1 | Patch available | GHSA-v6wh-96g9-6wx3 |
| — | vite (npm) | 8.0.0 to before 8.0.16 | 8.0.16 | Patch available | GHSA-v6wh-96g9-6wx3 |
| — | vite (npm) | 7.0.0 to before 7.3.5 | 7.3.5 | Patch available | GHSA-v6wh-96g9-6wx3 |
| — | vite (npm) | before 6.4.3 | 6.4.3 | Patch available | GHSA-v6wh-96g9-6wx3 |
| — | vite-plus (npm) | before 0.1.24 | 0.1.24 | Patch available | GHSA-v6wh-96g9-6wx3 |
- launch-editor Vendorvitejs Affected before 2.14.1 Fixed in 2.14.1 Patch available CNA
- vite Vendorvitejs Affected 8.0.0 to before 8.0.16; 7.0.0 to before 7.3.5; before 6.4.3 Fixed in 8.0.16, 7.3.5, 6.4.3 Patch available CNA
- vite-plus Vendorvitejs Affected before 0.1.24 Fixed in 0.1.24 Patch available CNA
- launch-editor (npm) Vendor— Affected before 2.14.1 Fixed in 2.14.1 Patch available GHSA-v6wh-96g9-6wx3
- vite (npm) Vendor— Affected 8.0.0 to before 8.0.16 Fixed in 8.0.16 Patch available GHSA-v6wh-96g9-6wx3
- vite (npm) Vendor— Affected 7.0.0 to before 7.3.5 Fixed in 7.3.5 Patch available GHSA-v6wh-96g9-6wx3
- vite (npm) Vendor— Affected before 6.4.3 Fixed in 6.4.3 Patch available GHSA-v6wh-96g9-6wx3
- vite-plus (npm) Vendor— Affected before 0.1.24 Fixed in 0.1.24 Patch available GHSA-v6wh-96g9-6wx3
Remediation
- Fix · CNA launch-editor (vitejs) Fixed in 2.14.1
- Fix · CNA vite (vitejs) Fixed in 8.0.16, 7.3.5, 6.4.3
- Fix · CNA vite-plus (vitejs) Fixed in 0.1.24
- Fix · GHSA-v6wh-96g9-6wx3 launch-editor (npm) Fixed in 2.14.1 Advisory →
- Fix · GHSA-v6wh-96g9-6wx3 vite (npm) Fixed in 8.0.16 Advisory →
- Fix · GHSA-v6wh-96g9-6wx3 vite (npm) Fixed in 7.3.5 Advisory →
- Fix · GHSA-v6wh-96g9-6wx3 vite (npm) Fixed in 6.4.3 Advisory →
- Fix · GHSA-v6wh-96g9-6wx3 vite-plus (npm) Fixed in 0.1.24 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
Not affected: 20 products
- Cryostat 4
- Migration Toolkit for Containers
- Node HealthCheck Operator
- OpenShift Lightspeed
- OpenShift Pipelines
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Red Hat AMQ Broker 7
- Red Hat Ansible Automation Platform 2
- Red Hat Build of Podman Desktop
- Red Hat Data Grid 8
- Red Hat Developer Hub 1
- Red Hat Discovery 2
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Virtualization 4
- Red Hat Quay 3
- Red Hat build of Apache Camel - HawtIO 4
- Self-service automation portal 2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-53632
- 2026-10-03 Alias added: GHSA-v6wh-96g9-6wx3
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
References
More vitejs vulnerabilities
- TI-2025-22386 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query KEVCVSS 3.1HIGH 7.5
- TI-2025-41248 Code injection in vitejs vite-plugin-react CVSS 3.1CRITICAL 9.8
- TI-2026-28350 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket CVSS 4.0HIGH 8.2
- TI-2025-41735 @vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development CVSS 3.1HIGH 7.5
- TI-2025-21544 Vite bypasses server.fs.deny when using `?raw??` CVSS 3.1HIGH 7.5
- TI-2023-16938 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) CVSS 3.1HIGH 7.5
Sources
- CVE-2026-53632 · CVE Program
- CVE-2026-53632 · NVD
- FIRST EPSS
- GHSA-v6wh-96g9-6wx3 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-53632 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences