medium·Product Based Web Vulnerabilities·Updated Apr 8, 2026

Vite Dev Server - Path Traversal in Optimized Deps .map Handling

Est. Time~10 seconds

Scan TypeGroup Scan

Targetsdomain, subdomain, ipv4

CostFree

Times Used

continuous scan runs

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

CVECVE-2026-39365

6.3

CVSSmedium

Exploitable remotely over the internet · no authentication required.

Description

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

Affected

viteby vitejs

>= 8.0.0, < 8.0.5

vite-plusby vitejs

< 0.1.16

Updated Nov 10, 2026View on NVD →

Similar Tools

Check your infrastructure.
Right now.

12,000+ scanners. Free to start. No credit card required.

Vite Dev Server - Path Traversal in Optimized Deps .map Handling

Check your infrastructure.Right now.

Check your infrastructure.
Right now.