Vite Dev Server - Path Traversal in Optimized Deps .map Handling
Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePath(path.resolve(root, url.slice(1))) and calls readFile without restricting ../ segments in the URL. This allows an attacker to bypass server.fs.strict and retrieve auto-generated sourcemaps for files located outside the project root, leaking absolute filesystem paths. Only dev servers explicitly exposed to the network using --host or server.host are affected. References: https://github.com/advisories/GHSA-4w7w-66w2-5vf9 https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9 https://nvd.nist.gov/vuln/detail/CVE-2026-39365 Remediation: Upgrade Vite to version 8.0.5, 7.3.2, 6.4.2 or later.
Used 20 times · 10 assets checked · domain, subdomain, ipv4