CVE-2026-39365

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-39365
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39365.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-39365
Aliases
Downstream
CGA (80)
CLSA (8)
MINI (7)
ROOT (1)
Published
2026-04-07T19:13:50Z
Modified
2026-10-22T02:47:59Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Vite has a Path Traversal in Optimized Deps `.map` Handling
Details

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39365.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "0.1.16"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StringRangeExpression"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/vitejs/vite

Affected ranges

Type
GIT
Repo
https://github.com/vitejs/vite
Events
Introduced
b565af6f1123a62b3058253b2147574b8515e89f
Fixed
1a12d4ca4c62eedaeaf734d722b27ab17b5b1dd0
Introduced
b85f32275b443bf6b647572a9209f1e078b5b4dd
Fixed
cc383e07b66d4c5a9768fcb570e0af812cb8d999
Introduced
814120f2ad387ca3d1e16c7dd403b04ca4b97f75
Fixed
6b3fad02abd550bd7b79934ff92c58dbd7f33045
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "8.0.0"
                },
                {
                    "fixed":  "8.0.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "7.0.0"
                },
                {
                    "fixed":  "7.3.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "6.0.0"
                },
                {
                    "fixed":  "6.4.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        }
    ]
}

Affected versions

create-vite@6.*
create-vite@6.0.0
create-vite@6.0.1
create-vite@6.1.0
create-vite@6.1.1
create-vite@6.2.0
create-vite@6.2.1
create-vite@6.3.0
create-vite@6.3.1
create-vite@6.4.0
create-vite@6.4.1
create-vite@6.5.0
create-vite@7.*
create-vite@7.0.0
create-vite@7.0.1
create-vite@7.0.2
create-vite@7.0.3
create-vite@7.1.0
create-vite@7.1.1
create-vite@7.1.2
create-vite@7.1.3
create-vite@8.*
create-vite@8.0.0
create-vite@8.0.0-beta.0
create-vite@8.0.1
create-vite@8.0.2
create-vite@8.0.3
create-vite@8.1.0
create-vite@8.2.0
create-vite@8.3.0
create-vite@9.*
create-vite@9.0.0
create-vite@9.0.1
create-vite@9.0.2
create-vite@9.0.3
create-vite@9.0.4
plugin-legacy@6.*
plugin-legacy@6.0.0
plugin-legacy@6.0.1
plugin-legacy@6.0.2
plugin-legacy@6.1.0
plugin-legacy@6.1.1
plugin-legacy@7.*
plugin-legacy@7.0.0
plugin-legacy@7.0.1
plugin-legacy@7.1.0
plugin-legacy@7.2.0
plugin-legacy@7.2.1
plugin-legacy@8.*
plugin-legacy@8.0.0
plugin-legacy@8.0.1
v6.*
v6.0.0
v6.0.1
v6.0.10
v6.0.11
v6.0.2
v6.0.3
v6.0.4
v6.0.5
v6.0.6
v6.0.7
v6.0.8
v6.0.9
v6.1.0
v6.1.0-beta.0
v6.1.0-beta.1
v6.1.0-beta.2
v6.1.1
v6.2.0
v6.2.0-beta.0
v6.2.0-beta.1
v6.2.1
v6.2.2
v6.3.0
v6.3.0-beta.0
v6.3.0-beta.1
v6.3.0-beta.2
v6.3.1
v6.3.2
v6.3.3
v6.3.4
v6.3.5
v6.3.6
v6.3.7
v6.4.0
v6.4.1
v7.*
v7.0.0
v7.0.1
v7.0.2
v7.0.3
v7.0.4
v7.0.5
v7.0.6
v7.1.0
v7.1.0-beta.0
v7.1.0-beta.1
v7.1.1
v7.1.10
v7.1.11
v7.1.2
v7.1.3
v7.1.4
v7.1.5
v7.1.6
v7.1.7
v7.1.8
v7.1.9
v7.2.0
v7.2.0-beta.0
v7.2.0-beta.1
v7.2.1
v7.2.2
v7.2.3
v7.2.4
v7.2.5
v7.2.6
v7.2.7
v7.3.0
v7.3.1
v8.*
v8.0.0
v8.0.1
v8.0.2
v8.0.3
v8.0.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39365.json"