PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39365 vitejs CVE debrief

The CVE record for CVE-2026-39365 was published on 2026-04-07T20:16:30.350Z and has not been modified since then. The NVD entry is currently Analyzed. This vulnerability affects Vite, a frontend tooling framework for JavaScript, from version 6.0.0 to before versions 6.4.2, 7.3.2, and 8.0.5. The vulnerability class involves path traversal in the dev server's handling of .map requests for optimized dependencies. The likely operational impact includes potential exposure of .map files located outside the project root. The source confidence is limited by the information available in the CVE record and NVD entry.

Vendor
vitejs
Product
vite
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-07
Original CVE updated
2026-07-24
Advisory published
2026-04-07
Advisory updated
2026-07-24

Who should care

Users of Vite versions 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5 should be aware of this vulnerability. This includes operators of systems using Vite for frontend tooling, platform administrators, vulnerability management teams, and security teams responsible for monitoring and mitigating potential exposures.

Technical summary

The dev server's handling of .map requests for optimized dependencies in Vite versions 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5 resolves file paths and calls readFile without restricting ../ segments in the URL. This allows bypassing of the server.fs.strict allow list and retrieval of .map files located outside the project root, provided they can be parsed as valid source map JSON. The vulnerability is fixed in Vite versions 6.4.2, 7.3.2, and 8.0.5. Users should update to one of these versions to mitigate the vulnerability.

Defensive priority

Medium priority due to CVSS score of 6.3 and potential impact on exposed systems.

Recommended defensive actions

  • Update Vite to version 6.4.2, 7.3.2, or 8.0.5
  • Review and restrict access to .map files
  • Implement additional monitoring and logging
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is fixed in Vite versions 6.4.2, 7.3.2, and 8.0.5. Users should update to one of these versions to mitigate the vulnerability. This issue involves path traversal in the dev server's handling of .map requests for optimized dependencies. The server resolves file paths and calls readFile without restricting ../ segments in the URL, allowing bypass of the server.fs.strict allow list. Affected users should review and restrict access to .map files, and implement additional monitoring and logging. The CVE record was published on 2026-04-07T20:16:30.350Z and has not been modified since then.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-07T20:16:30.350Z and has not been modified since then. The NVD entry is currently Analyzed.