CVE-2026-39365

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:vitejs:vite::::::node.js::*
	cpe:2.3:a:vitejs:vite::::::node.js::*
	cpe:2.3:a:vitejs:vite::::::node.js::*
	cpe:2.3:a:vitejs:vite-plus::::::node.js::*

History

15 Apr 2026, 19:58

Type	Values Removed	Values Added
References	~~() https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9 -~~	() https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9 - Exploit, Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.3
CPE		cpe:2.3:a:vitejs:vite::::::node.js::* cpe:2.3:a:vitejs:vite-plus::::::node.js::*
First Time		Vitejs Vitejs vite Vitejs vite-plus

07 Apr 2026, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-07 20:16

Updated : 2026-04-15 19:58

NVD link : CVE-2026-39365

Mitre link : CVE-2026-39365

CVE.ORG link : CVE-2026-39365

JSON object : View

Products Affected

vitejs

vite
vite-plus

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-39365", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-04-07T20:16:30.350", "references": [{"url": "https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server\u2019s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5."}], "lastModified": "2026-04-15T19:58:54.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "FE1AE8AE-8504-4C45-A361-8EF1F8D573AD", "versionEndIncluding": "6.4.1", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "8D4169B2-49CC-4174-B1AB-2D61D3441617", "versionEndIncluding": "7.3.1", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "51F8A931-4520-4696-89C4-7F94228654F5", "versionEndIncluding": "8.0.4", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:vitejs:vite-plus:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "5DE81A10-D69F-4578-8EF1-9817F5E9ED22", "versionEndIncluding": "0.1.15"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}