Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the launch-editor npm package because it failed to properly sanitize input file paths. Specifically, on Windows systems, it was possible to pass a UNC (Universal Naming Convention) path to the launchEditor function. When the function attempted to check for the file's existence using fs.existsSync, the Windows OS would automatically try to connect to the remote share specified in the UNC path. This process involves NTLM authentication, during which the user's NTLMv2 password hash is sent to the remote server. An attacker could set up a malicious SMB server to receive this hash and then attempt to crack it offline to recover the user's password. The patch introduced a check at the beginning of the launchEditor function to detect and block UNC paths on Windows, thus preventing the underlying file system operation that triggers the NTLM authentication and subsequent hash disclosure.
launchEditorpackages/launch-editor/index.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| launch-editor | npm | <= 2.14.0 | 2.14.1 |
| vite | npm | >= 8.0.0, <= 8.0.15 | 8.0.16 |
| vite | npm | >= 7.0.0, <= 7.3.4 | 7.3.5 |
| vite | npm | <= 6.4.2 | 6.4.3 |
| vite-plus | npm | <= 0.1.23 | 0.1.24 |