launch-editor is a Node.js package that lets users open a file at a specific line number in an editor. Before version 2.14.1, the package could resolve any file path, including Windows UNC paths. When a UNC path is opened, Windows initiates NTLM authentication to the target host. The authentication exchange leaks the user’s NTLMv2 hash to the SMB server that receives the request. An attacker who controls that SMB server can capture the hash and later crack it offline, resulting in credential compromise.

The vulnerability affects the launch-editor NPM package from vitejs. Users of versions prior to 2.14.1—specifically vitejs:launch-editor, vitejs:vite, and vitejs:vite-plus—are impacted. Updating the package to 2.14.1 or later resolves the issue.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is not reported, which means an exact exploitation likelihood cannot be quantified from the available data. The vulnerability is not listed in CISA KEV. Exploitation requires the attacker to host a malicious SMB share and lure a victim into opening a UNC path via launch-editor; once the victim opens the path, the hash is transmitted. No additional prerequisites beyond the victim using the vulnerable package are stated, so the risk is limited to machines that run Node.js with the older launch-editor package.