CVE-2026-39364: vitejs vite
CVSS: 8.2v4.0HighModified
AliasesCGA-3rhv-645g-4v9gCGA-5f55-mfqr-cmhjCGA-8gcw-957f-7c87CGA-px87-mcwj-j28xGHSA-v2wj-q39q-566rCGA-3h3c-vx74-jpgmCGA-3hr5-m54m-9864CGA-3wv3-rwm4-m7qvCGA-54fv-6h3x-v9mxCGA-5g2v-cmwf-p967CGA-62cv-6x3g-776mCGA-6547-pmhr-mrwqCGA-6hgq-px4h-259rCGA-7fpx-5fp4-mm3qCGA-7xcg-vwqr-xhpcCGA-88r2-qqvf-r5cfCGA-8pc3-2w7c-pm9cCGA-8v5j-qg4f-j5c6CGA-8wp4-5gch-m77cCGA-98p4-rwm4-p9hhCGA-9h58-hfxq-6j49CGA-9q2g-89rh-m85fCGA-9qqq-wmh4-v8xfCGA-c8c6-445h-wq76CGA-cjq2-9mw5-3w34CGA-cv57-phmv-2wr2CGA-fc2h-6vfp-jxrpCGA-ffp2-pv4c-c6j7CGA-fjh6-33jw-jrrvCGA-g5gx-4pwv-xp47CGA-g8f7-jmw6-8qh6CGA-gj2c-9wfp-6xrcCGA-gm7h-f4wm-67p2CGA-hg5r-36rm-v2xgCGA-hh6r-52qf-cghjCGA-j4w8-h8cw-jm3wCGA-j7hw-fq7f-7p7hCGA-j945-mj7x-r6cfCGA-m62x-rxm6-jjgrCGA-m82h-pqxx-wq6gCGA-m96v-fjxc-36r5CGA-mhcv-h3wr-hgccCGA-mmmw-pcfg-vvqvCGA-pc3r-f6fv-jfjrCGA-pc49-3v23-wwrcCGA-pwx5-g36p-g2qvCGA-q54c-wjwq-8mq4CGA-q8f8-m9wp-jh36CGA-qh43-v7rf-jqxfCGA-qp9h-m22w-mwvpCGA-r258-wr5q-6hmpCGA-r9c9-c3ch-j69hCGA-rmg3-v3hx-wq68CGA-rmhp-7r72-9q55CGA-v82g-5fqr-fcjxCGA-w4r6-79v9-2vgjCGA-w872-hrwm-qh2mCGA-wc6w-6gqm-wcqmCGA-wqpg-v55f-46pmCGA-wx5q-c27c-3rq9CGA-xf33-ch5p-q727
Published 07-04-2026Last modified 17-08-2026
Vulnerability summary
CVE-2026-39364 is a high (CVSS 8.2) vulnerability in vitejs vite. EPSS estimates a 1.54% chance of exploitation in the next 30 days, higher than 74.4% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.2/10
010
High · v4.0 (CVE.org)EPSS score
1.54%
0%100%
Low · -0.46 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 07-04-2026PublishedVulnerability first disclosed.
- 17-08-2026Last modifiedVulnerability information updated.
Description
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
CVSS metrics
7 scores · 5 sources · 2 versionsHigh 8.2Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · NpmEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- NVDNIST8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 2 agree
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.54%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
-0.46 pp
From 2.00% on 20-09-2026
20-09-202620-10-2026
EPSS score1.54%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundVite
Maturity: poc
Weaknesses
CWE · root cause- CWE-180Incorrect Behavior Order: Validate Before CanonicalizeThe product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.
- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-472External Control of Assumed-Immutable Web ParameterThe web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
Affected systems
Chainguard30 products
- commercial-gitlab-rails-ee-19.1< 19.1.7-r3
- commercial-gitlab-rails-ee-19.2< 19.2.7-r1
- commercial-gitlab-rails-ee-19.3< 19.3.3-r1
- commercial-gitlab-rails-ee-19.4< 19.4.1-r1
- commercial-gitlab-rails-ee-fips-19.1All versions (No fix recorded)
Vitejs2 products
Wolfi2 products
- vite< 8.0.11-r0
- vitess-23< 23.0.3-r11
Npm1 product
- vite≥ 8.0.0, < 8.0.5 | ≥ 7.1.0, < 7.3.2
Voidzero1 product
- vite\+≤ 0.1.15
5 vendors · 36 products
References
12 links- github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566rX Refsource CONFIRMAdvisoryWEBExploitVendor Advisory
- github.com/vitejs/vitePACKAGE