Bug 2491437 (CVE-2026-53632)

Summary:	CVE-2026-53632 launch-editor: launch-editor: Credential compromise via NTLMv2 password hash leak through UNC path access
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, abarbaro, abrianik, alizardo, anpicker, ataylor, bbrownin, bdettelb, brasmith, cdrage, cmah, cochase, dbruscin, dkeler, doconnor, dranck, dschmidt, dymurray, eaguilar, ebaron, ehugonne, erezende, fdeutsch, ggrzybek, hasun, ibolton, jchui, jfula, jhe, jkoehler, jlanda, jmatthew, jmontleo, jolong, jowilson, jraez, jwong, kshier, ktsao, kvanderr, lphiri, nboldt, nyancey, oaljalju, omaciel, ometelka, oramraz, parichar, pgaikwad, pjindal, psrna, ptisnovs, rjohnson, rushinde, simaishi, slucidi, smullick, sseago, stcannon, stirabos, suppawar, syedriko, tasato, teagle, thason, ttakamiy, xdharmai, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in launch-editor. This component, used in Node.js to open files, can be tricked into accessing arbitrary paths, including Windows Universal Naming Convention (UNC) paths. When a malicious UNC path is opened, Windows automatically attempts NTLM authentication to a remote server controlled by an attacker. This action leaks the user's NTLMv2 password hash, which can then be used by an attacker to compromise user credentials through offline cracking.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-22 18:01:18 UTC

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.