CVE-2026-39365 Scanner
CVE-2026-39365 Scanner - Path Traversal vulnerability in Vite Dev Server
Used 2.8k times · 4.2k assets checked · domain, subdomain, ipv4
CVE
CVE-2026-39365
6.3
CVSSmedium
Exploitable remotely over the internet · no authentication required.
Description
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
vitevite-plus
Updated Nov 6, 2026View on NVD →
S4E scanner
CVE history: vite
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →