CVE-2026-39365

Any files ending with .map even out side the project can be returned to the browser.

Details

In Vite v7.3.1, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON.

PoC

1. Create a minimal PoC sourcemap outside the project root

   cat > /tmp/poc.map <<'EOF'
   {"version":3,"file":"x.js","sources":[],"names":[],"mappings":""}
   EOF
   

2. Start the Vite dev server (example)

   pnpm -C playground/fs-serve dev --host 127.0.0.1 --port 18080
   

3. Confirm that direct /@fs access is blocked by strict (returns 403)
4. Inject ../ segments under the optimized deps .map URL prefix to reach /tmp/poc.map

Only apps that match the following conditions are affected:

• explicitly exposes the Vite dev server to the network (using --host or server.host config option)
• have a sensitive content in files ending with .map and the path is predictable

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

Kodem intelligence

1. What is CVE-2026-39365? CVE-2026-39365 is a medium-severity path traversal vulnerability in vite (npm), affecting versions >= 8.0.0, <= 8.0.4. It is fixed in 8.0.5, 7.3.2, 6.4.2. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. Which versions of vite are affected by CVE-2026-39365? vite (npm) versions >= 8.0.0, <= 8.0.4 is affected.
3. Is there a fix for CVE-2026-39365? Yes. CVE-2026-39365 is fixed in 8.0.5, 7.3.2, 6.4.2. Upgrade to this version or later.
4. Is CVE-2026-39365 exploitable, and should I be worried? Whether CVE-2026-39365 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-39365 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-39365?
   • Upgrade vite to 8.0.5 or later
   • Upgrade vite to 7.3.2 or later
   • Upgrade vite to 6.4.2 or later