High severity7.5NVD Advisory· Published Apr 7, 2026· Updated Aug 4, 2026
CVE-2026-39364
CVE-2026-39364
Description
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
vitenpm | >= 8.0.0, < 8.0.5 | 8.0.5 |
vitenpm | >= 7.1.0, < 7.3.2 | 7.3.2 |
Affected products
12- osv-coords10 versionspkg:apk/chainguard/gitlab-rails-ce-19.1pkg:apk/chainguard/gitlab-rails-ce-fips-19.1pkg:apk/chainguard/gitlab-rails-ce-fips-19.2pkg:apk/chainguard/vitepkg:apk/chainguard/vitess-22pkg:apk/chainguard/vitess-23pkg:apk/wolfi/vitepkg:apk/wolfi/vitess-22pkg:apk/wolfi/vitess-23pkg:npm/vite
< 19.1.2-r2+ 9 more
- (no CPE)range: < 19.1.2-r2
- (no CPE)range: < 19.1.1-r3
- (no CPE)range: < 19.2.1-r1
- (no CPE)range: < 8.0.11-r0
- (no CPE)range: < 22.0.4-r9
- (no CPE)range: < 23.0.3-r11
- (no CPE)range: < 8.0.11-r0
- (no CPE)range: < 22.0.4-r9
- (no CPE)range: < 23.0.3-r11
- (no CPE)range: >= 8.0.0, < 8.0.5
Patches
Vulnerability mechanics
References
11- github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566rnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-v2wj-q39q-566rghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-39364ghsaADVISORY
- github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ffghsaWEB
- github.com/vitejs/vite/pull/22160ghsaWEB
- github.com/vitejs/vite/releases/tag/v7.3.2ghsaWEB
- github.com/vitejs/vite/releases/tag/v8.0.5ghsaWEB
- access.redhat.com/errata/RHSA-2026:24866nvd
- access.redhat.com/security/cve/CVE-2026-39364nvd
- bugzilla.redhat.com/show_bug.cginvd
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39364.jsonnvd
News mentions
0No linked articles in our index yet.