Vulnerability Description
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vitejs | Vite | >= 7.0.0, <= 7.3.1 |
| Voidzero | Vite\+ | <= 0.1.15 |
Related Weaknesses (CWE)
References
- https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566rExploitVendor Advisory
FAQ
What is CVE-2026-39364?
CVE-2026-39364 is a vulnerability with a CVSS score of 7.5 (HIGH). Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved w...
How severe is CVE-2026-39364?
CVE-2026-39364 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-39364?
Check the references section above for vendor advisories and patch information. Affected products include: Vitejs Vite, Voidzero Vite\+.