Vulnerability · Published Apr 7, 2026 · Assigned by GitHub_M

CVE-2026-39365Vite has a Path Traversal in Optimized Deps `.map` Handling

Medium 6.3

In plain English

A medium-severity path traversal in vite from vitejs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.9%top 39.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	vite	8.0.5	GHSA-4w7w-66w2-5vf9
npm	vite	7.3.2	GHSA-4w7w-66w2-5vf9
npm	vite	6.4.2	GHSA-4w7w-66w2-5vf9

Affected products (as reported)

Vendor	Product	Versions
vitejs	vite	>= 8.0.0, < 8.0.5>= 7.0.0, < 7.3.2>= 6.0.0, < 6.4.2
vitejs	vite-plus	< 0.1.16

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9 x_refsource_CONFIRM