CVE-2026-53632: vitejs launch-editor External Control of File Name or Path
CVSS: 5.5v4.0MediumDeferred
AliasesCGA-9g6j-jx5g-crgqCGA-fgxp-cj3r-x9p8GHSA-v6wh-96g9-6wx3CGA-237r-qhfr-6p94CGA-26cf-xq2j-wv72CGA-27h5-ff4x-2qf7CGA-28wg-gpfp-23ppCGA-2xvr-vgm6-frf2CGA-37g8-882w-948mCGA-3fjw-ffpr-4xcgCGA-3gh5-3wr5-4pvvCGA-3jx3-76rv-2992CGA-3qjx-h9mh-fpgcCGA-3vfx-99f5-73jjCGA-3vqc-qv85-37p5CGA-424x-pxc9-qvwrCGA-44gj-v6vr-m9p5CGA-457c-hff3-6fc2CGA-47cv-55gm-5rp5CGA-4hpm-8xq8-6gpvCGA-4xx5-3f4w-pjr2CGA-4xxq-3rq9-f8mwCGA-56hh-qrjw-2cg4CGA-58m3-qx93-vfqcCGA-5h9h-qg6f-g5q3CGA-5j7c-9xfg-7qmcCGA-624v-xxqr-hh2fCGA-62cq-w3jh-9pfqCGA-63cq-wv6g-2f7wCGA-64ff-vwqg-cjv2CGA-64gf-pwgf-9g72CGA-657q-v677-jx38CGA-66c4-8hjp-gh6cCGA-67h5-7hxr-56hcCGA-6f8p-fhg4-2c6qCGA-72pw-pwgh-5fp3CGA-73gq-q2g7-2cgrCGA-74hx-7f36-5v94CGA-74x5-q7w3-vfhjCGA-752c-9mjr-rr74CGA-754h-x29v-w4pjCGA-77qf-73m6-35hfCGA-7jwm-q2m4-gvgmCGA-7m3q-phcg-5h95CGA-7rh3-8fpw-7vjxCGA-7v55-69mw-8jfgCGA-7w96-6m6c-769cCGA-7wpx-6vjp-9mcfCGA-8mf9-fwhm-432pCGA-8mv6-mc5h-g24gCGA-8q54-hj6c-7jr5CGA-8rjm-wwp4-67wmCGA-9265-rv4p-6v4pCGA-92ch-5pr3-wxfpCGA-94q8-mx5q-7q9vCGA-96rv-cg6p-m875CGA-9c37-7hr3-jcxfCGA-9hjh-2gxj-376hCGA-9mhr-mr84-pf92CGA-c6qf-3hq3-h2rrCGA-cc9v-33wc-8wq3CGA-cqmx-wmph-35xcCGA-cqxh-rfpf-vjmrCGA-crfw-968f-3vj9CGA-cv4p-wp92-mmjgCGA-cw68-94j6-8mh3CGA-f54w-v83f-c3xwCGA-ffxw-2hmx-vrgpCGA-fxx2-64c3-jjwfCGA-g3mf-xghg-q634CGA-g7w2-4fc8-46r2CGA-gf4m-xv29-g2wpCGA-gq6g-g259-mhcvCGA-gxhg-cc9g-x6h2CGA-h8jr-69wm-mcjxCGA-hrvj-pjvv-r2p6CGA-hw9c-52hf-mrwgCGA-hx6f-hp7w-gfpcCGA-hxv7-m7xm-cf9cCGA-j33g-v6pr-mvhvCGA-j3g9-89wq-h543CGA-j4h5-q93p-xr59CGA-j798-3hqj-x477CGA-j88h-3mmg-56hcCGA-j8xx-83g9-2rjwCGA-jrpm-5mc4-p6h5CGA-jx8q-p9cp-qw84CGA-m3x8-v7gh-28v8CGA-mcgw-h2f9-2fg8CGA-mfv3-686g-f4pvCGA-mprh-2j5q-9j55CGA-p2gr-3m2q-w6v7CGA-p567-w5w4-95h9CGA-pm84-j9rm-cjr3CGA-pr6w-xm4g-3h93CGA-px67-xr8h-cxjpCGA-q963-qchf-xq7cCGA-qmc2-7276-f3qcCGA-qwcg-62x5-8g24CGA-r582-r4xx-v9jwCGA-rpjv-f6jw-pgmmCGA-rvg9-q468-gfqvCGA-rvhx-f24w-cqmqCGA-v4q9-mw3j-xq9hCGA-vchw-fg89-85vhCGA-vphm-3g45-x2qcCGA-w295-rwxg-24qrCGA-wjh8-77q2-c4jjCGA-wqfq-5cq6-p7pfCGA-wr7x-rv6j-fmm2CGA-wrgh-xhm6-m4rgCGA-wx39-qhx2-6r3vCGA-xgj9-vv8h-9hffCGA-xjjm-4hq4-v7w3CGA-xm6r-2xpc-qc3fCGA-xmww-cr5m-h32qCGA-xp5q-7c45-5wm4
Published 22-06-2026Last modified 22-06-2026
Vulnerability summary
CVE-2026-53632 is a medium (CVSS 5.5) External Control of File Name or Path vulnerability in vitejs launch-editor. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 33.7% of scored vulnerabilities.
CVSS score
5.5/10
010
Medium · v4.0 (CVE.org)EPSS score
0.41%
0%100%
Low · -0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 22-06-2026PublishedVulnerability first disclosed.
- 22-06-2026Last modifiedVulnerability information updated.
Description
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 5.5Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:HSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated5.5MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
- OSV · NpmEcosystem advisory · calculated5.5MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
- OSV · ChainguardEcosystem advisory · calculated5.5MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
- NVDNIST5.5MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
-0.02 pp
From 0.43% on 20-09-2026
20-09-202620-10-2026
EPSS score0.41%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Affected systems
Chainguard36 products
- arangodb-3.11< 3.11.14.5-r6
- arangodb-3.12< 3.12.9.4-r19
- argo-workflows-ui-3.6< 3.6.19-r7
- commercial-gitlab-rails-ee-19.1< 19.1.7-r3
- commercial-gitlab-rails-ee-19.2< 19.2.7-r1
Npm3 products
- launch-editor< 2.14.1
- vite≥ 8.0.0, < 8.0.16 | ≥ 7.0.0, < 7.3.5 | < 6.4.3
- vite-plus< 0.1.24
Vitejs3 products
- launch-editor< 2.14.1
- vite≥ 8.0.0, < 8.0.16 | ≥ 7.0.0, < 7.3.5 | < 6.4.3
- vite-plus< 0.1.24
Wolfi1 product
- nextcloud-server-33< 33.0.6-r2
4 vendors · 43 products
References
4 links- github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3X Refsource CONFIRMAdvisoryWEB
