CVE Feed

    Dashboard / CVE / CVE-2026-39365

    CVE-2026-39365

    Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.

    Published:Apr 7, 2026
    Last Modified:Apr 30, 2026
    EPS:Apr 7, 2026
    EPSS Score:0.01151
    CVSS Score:5.3

    Affected Products

    Vendor
    Vitejs
    Product
    Vite
    Vendor
    Vitejs
    Product
    Vite-plus
    Vendor
    Voidzero
    Product
    Vite\+

    Exploits

    https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9

    Related CVEs

    CVE-2026-53571 (CVSS 8.2) — Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files …
    CVE-2026-53632 (CVSS 5.5) — launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch…
    CVE-2024-52011 (CVSS 7.5) — launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due…
    CVE-2026-39364 (CVSS 8.2) — Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev ser…
    CVE-2026-39363 (CVSS 8.2) — Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is po…
    CVE-2025-62522 (CVSS 6) — Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before …
    CVE-2025-58752 (CVSS 2.3) — Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HT…
    CVE-2025-58751 (CVSS 2.3) — Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files …
    CVE-2025-46565 (CVSS 6) — Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14…
    CVE-2025-32395 (CVSS 6) — Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the co…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High