{"schemaVersion":3,"id":"CVE-2026-39364","aliases":["CGA-3rhv-645g-4v9g","CGA-5f55-mfqr-cmhj","CGA-8gcw-957f-7c87","CGA-px87-mcwj-j28x","GHSA-v2wj-q39q-566r","CGA-3h3c-vx74-jpgm","CGA-3hr5-m54m-9864","CGA-3wv3-rwm4-m7qv","CGA-54fv-6h3x-v9mx","CGA-5g2v-cmwf-p967","CGA-62cv-6x3g-776m","CGA-6547-pmhr-mrwq","CGA-6hgq-px4h-259r","CGA-7fpx-5fp4-mm3q","CGA-7xcg-vwqr-xhpc","CGA-88r2-qqvf-r5cf","CGA-8pc3-2w7c-pm9c","CGA-8v5j-qg4f-j5c6","CGA-8wp4-5gch-m77c","CGA-98p4-rwm4-p9hh","CGA-9h58-hfxq-6j49","CGA-9q2g-89rh-m85f","CGA-9qqq-wmh4-v8xf","CGA-c8c6-445h-wq76","CGA-cjq2-9mw5-3w34","CGA-cv57-phmv-2wr2","CGA-fc2h-6vfp-jxrp","CGA-ffp2-pv4c-c6j7","CGA-fjh6-33jw-jrrv","CGA-g5gx-4pwv-xp47","CGA-g8f7-jmw6-8qh6","CGA-gj2c-9wfp-6xrc","CGA-gm7h-f4wm-67p2","CGA-hg5r-36rm-v2xg","CGA-hh6r-52qf-cghj","CGA-j4w8-h8cw-jm3w","CGA-j7hw-fq7f-7p7h","CGA-j945-mj7x-r6cf","CGA-m62x-rxm6-jjgr","CGA-m82h-pqxx-wq6g","CGA-m96v-fjxc-36r5","CGA-mhcv-h3wr-hgcc","CGA-mmmw-pcfg-vvqv","CGA-pc3r-f6fv-jfjr","CGA-pc49-3v23-wwrc","CGA-pwx5-g36p-g2qv","CGA-q54c-wjwq-8mq4","CGA-q8f8-m9wp-jh36","CGA-qh43-v7rf-jqxf","CGA-qp9h-m22w-mwvp","CGA-r258-wr5q-6hmp","CGA-r9c9-c3ch-j69h","CGA-rmg3-v3hx-wq68","CGA-rmhp-7r72-9q55","CGA-v82g-5fqr-fcjx","CGA-w4r6-79v9-2vgj","CGA-w872-hrwm-qh2m","CGA-wc6w-6gqm-wcqm","CGA-wqpg-v55f-46pm","CGA-wx5q-c27c-3rq9","CGA-xf33-ch5p-q727"],"status":"published","duplicateOf":null,"title":null,"description":"Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.","dates":{"published":"2026-04-07T19:12:47.577Z","modified":"2026-08-17T12:05:13.339Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.2,"severity":"high","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":8.2,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":8.2,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Npm","score":8.2,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":8.2,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.2,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01535,"percentile":0.74489,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":-0.4609999999999998,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.01996},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01535,"percentile":0.74489}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01996,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01535,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01535,"percentile":0.74489}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_VITEJS_VITE","name":"Vite","source":"github","url":"https://github.com/vitejs/vite/issues/8498","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-180","name":"Incorrect Behavior Order: Validate Before Canonicalize","description":"The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.","type":"weakness","status":"Draft","abstraction":"Variant","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/180.html"},{"id":"CWE-284","name":"Improper Access Control","description":"The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.","type":"weakness","status":"Incomplete","abstraction":"Pillar","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/284.html"},{"id":"CWE-472","name":"External Control of Assumed-Immutable Web Parameter","description":"The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/472.html"}],"affected":[{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.1","name":"commercial-gitlab-rails-ee-19.1","label":"commercial-gitlab-rails-ee-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.1","purlType":"apk","versions":[{"text":"< 19.1.7-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.7-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.2","name":"commercial-gitlab-rails-ee-19.2","label":"commercial-gitlab-rails-ee-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.2","purlType":"apk","versions":[{"text":"< 19.2.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.7-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.3","name":"commercial-gitlab-rails-ee-19.3","label":"commercial-gitlab-rails-ee-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.3","purlType":"apk","versions":[{"text":"< 19.3.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.4","name":"commercial-gitlab-rails-ee-19.4","label":"commercial-gitlab-rails-ee-19.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.4","purlType":"apk","versions":[{"text":"< 19.4.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.4.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.1","name":"commercial-gitlab-rails-ee-fips-19.1","label":"commercial-gitlab-rails-ee-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.2","name":"commercial-gitlab-rails-ee-fips-19.2","label":"commercial-gitlab-rails-ee-fips-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.2","purlType":"apk","versions":[{"text":"< 19.2.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.7-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.3","name":"commercial-gitlab-rails-ee-fips-19.3","label":"commercial-gitlab-rails-ee-fips-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.3","purlType":"apk","versions":[{"text":"< 19.3.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.4","name":"commercial-gitlab-rails-ee-fips-19.4","label":"commercial-gitlab-rails-ee-fips-19.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.4","purlType":"apk","versions":[{"text":"< 19.4.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.4.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.10","name":"gitlab-rails-ce-18.10","label":"gitlab-rails-ce-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.11","name":"gitlab-rails-ce-18.11","label":"gitlab-rails-ce-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.11","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.5","name":"gitlab-rails-ce-18.5","label":"gitlab-rails-ce-18.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.5","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.6","name":"gitlab-rails-ce-18.6","label":"gitlab-rails-ce-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.7","name":"gitlab-rails-ce-18.7","label":"gitlab-rails-ce-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.8","name":"gitlab-rails-ce-18.8","label":"gitlab-rails-ce-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.9","name":"gitlab-rails-ce-18.9","label":"gitlab-rails-ce-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.0","name":"gitlab-rails-ce-19.0","label":"gitlab-rails-ce-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.1","name":"gitlab-rails-ce-19.1","label":"gitlab-rails-ce-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.1","purlType":"apk","versions":[{"text":"< 19.1.2-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.2-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.10","name":"gitlab-rails-ce-fips-18.10","label":"gitlab-rails-ce-fips-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.10","purlType":"apk","versions":[{"text":"< 18.10.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.10.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.11","name":"gitlab-rails-ce-fips-18.11","label":"gitlab-rails-ce-fips-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.11","purlType":"apk","versions":[{"text":"< 18.11.12-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.11.12-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.5","name":"gitlab-rails-ce-fips-18.5","label":"gitlab-rails-ce-fips-18.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.5","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.6","name":"gitlab-rails-ce-fips-18.6","label":"gitlab-rails-ce-fips-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.7","name":"gitlab-rails-ce-fips-18.7","label":"gitlab-rails-ce-fips-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.8","name":"gitlab-rails-ce-fips-18.8","label":"gitlab-rails-ce-fips-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.9","name":"gitlab-rails-ce-fips-18.9","label":"gitlab-rails-ce-fips-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.9","purlType":"apk","versions":[{"text":"< 18.9.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.0","name":"gitlab-rails-ce-fips-19.0","label":"gitlab-rails-ce-fips-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.0","purlType":"apk","versions":[{"text":"< 19.0.9-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.0.9-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.1","name":"gitlab-rails-ce-fips-19.1","label":"gitlab-rails-ce-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.1","purlType":"apk","versions":[{"text":"< 19.1.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.2","name":"gitlab-rails-ce-fips-19.2","label":"gitlab-rails-ce-fips-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.2","purlType":"apk","versions":[{"text":"< 19.2.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vite","name":"vite","label":"vite","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vite","purlType":"apk","versions":[{"text":"< 8.0.11-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.0.11-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-22","name":"vitess-22","label":"vitess-22","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-22","purlType":"apk","versions":[{"text":"< 22.0.4-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 22.0.4-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-23","name":"vitess-23","label":"vitess-23","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-23","purlType":"apk","versions":[{"text":"< 23.0.3-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.0.3-r11","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vite","name":"vite","label":"vite","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vite","purlType":"apk","versions":[{"text":"< 8.0.11-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.0.11-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vitess-23","name":"vitess-23","label":"vitess-23","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vitess-23","purlType":"apk","versions":[{"text":"< 23.0.3-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.0.3-r11","eol":null,"hubHref":null},{"vendor":"Npm","product":"vite","name":"vite","label":"vite","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/vite","purlType":"npm","versions":[{"text":"≥ 8.0.0, < 8.0.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.1.0, < 7.3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 8.0.0, < 8.0.5 | ≥ 7.1.0, < 7.3.2","eol":null,"hubHref":null},{"vendor":"vitejs","product":"vite","name":"vite","label":"vite","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 8.0.0, < 8.0.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.1.0, < 7.3.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, ≤ 7.3.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, ≤ 8.0.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 8.0.0, < 8.0.5 | ≥ 7.1.0, < 7.3.2 | ≥ 7.0.0, ≤ 7.3.1 | ≥ 8.0.0, ≤ 8.0.4","eol":null,"hubHref":"/vendor/vitejs/vite"},{"vendor":"vitejs","product":"vite-plus","name":"vite-plus","label":"vite-plus","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.1.16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.1.16","eol":null,"hubHref":"/vendor/vitejs/vite-plus"},{"vendor":"voidzero","product":"vite\\+","name":"vite\\+","label":"vite\\+","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 0.1.15","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 0.1.15","eol":null,"hubHref":"/vendor/voidzero/vite"}],"affectedCount":36,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r","label":"github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB","Exploit","Vendor Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39364","label":"access.redhat.com/security/cve/CVE-2026-39364","hostname":"access.redhat.com","tags":["VDB Entry","X Refsource REDHAT","Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456181","label":"bugzilla.redhat.com/show_bug.cgi?id=2456181","hostname":"bugzilla.redhat.com","tags":["Issue Tracking","X Refsource REDHAT","REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39364.json","label":"security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39364.json","hostname":"security.access.redhat.com","tags":["X Sadp Csaf Vex","WEB"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24866","label":"access.redhat.com/errata/RHSA-2026:24866","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39364.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39364.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39364","label":"nvd.nist.gov/vuln/detail/CVE-2026-39364","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/vitejs/vite/pull/22160","label":"github.com/vitejs/vite/pull/22160","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff","label":"github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/vitejs/vite","label":"github.com/vitejs/vite","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/vitejs/vite/releases/tag/v7.3.2","label":"github.com/vitejs/vite/releases/tag/v7.3.2","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/vitejs/vite/releases/tag/v8.0.5","label":"github.com/vitejs/vite/releases/tag/v8.0.5","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-4H3W-3VFR-57MM"]},"timeline":[{"kind":"published","date":"2026-04-07T19:12:47.577Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-08-17T12:05:13.339Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":43,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T23:39:02.983Z","stale":false,"partial":false}}