CVE-2026-39365 Details
Description
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
A path traversal vulnerability has been identified in Vite, a frontend tooling framework for JavaScript. This issue affects versions 6.0.0 prior to 6.4.2, as well as 7.0.0 through 7.3.1, and version 8.0.0 prior to 8.0.5. The vulnerability arises in the dev server's management of .map requests for optimized dependencies, where file paths are resolved and readFile is called without properly restricting ../ segments in the URL. Consequently, it is possible to bypass the server.fs.strict allow list and access .map files located outside the project root, provided these files can be parsed as valid source map JSON. This vulnerability is particularly concerning for applications that expose the Vite dev server to the network and have sensitive content in .map files with predictable paths.
Users can upgrade to Vite versions 6.4.2, 7.3.2, or 8.0.5, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vitejs vite | >= 6.0.0, <= 6.4.1 >= 7.0.0, <= 7.3.1 >= 8.0.0, <= 8.0.4 |
CPE
Remediation
| |
| voidzero vite+ | <= 0.1.15 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 30, 2026 | Reanalysis | [email protected] |
| Apr 15, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | New CVE Received | [email protected] |