High severity7.5NVD Advisory· Published Apr 7, 2026· Updated Apr 30, 2026
CVE-2026-39364
CVE-2026-39364
Description
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
vitenpm | >= 8.0.0, < 8.0.5 | 8.0.5 |
vitenpm | >= 7.1.0, < 7.3.2 | 7.3.2 |
Affected products
9- osv-coords7 versionspkg:apk/chainguard/vitepkg:apk/chainguard/vitess-22pkg:apk/chainguard/vitess-23pkg:apk/wolfi/vitepkg:apk/wolfi/vitess-22pkg:apk/wolfi/vitess-23pkg:npm/vite
< 8.0.11-r0+ 6 more
- (no CPE)range: < 8.0.11-r0
- (no CPE)range: < 22.0.4-r9
- (no CPE)range: < 23.0.3-r11
- (no CPE)range: < 8.0.11-r0
- (no CPE)range: < 22.0.4-r9
- (no CPE)range: < 23.0.3-r11
- (no CPE)range: >= 8.0.0, < 8.0.5
Patches
Vulnerability mechanics
References
7- github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566rnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-v2wj-q39q-566rghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-39364ghsaADVISORY
- github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ffghsaWEB
- github.com/vitejs/vite/pull/22160ghsaWEB
- github.com/vitejs/vite/releases/tag/v7.3.2ghsaWEB
- github.com/vitejs/vite/releases/tag/v8.0.5ghsaWEB
News mentions
0No linked articles in our index yet.