{"schemaVersion":3,"id":"CVE-2026-39365","aliases":["CGA-8m9r-wxfq-82v6","CGA-8mcr-ppc8-xccj","CGA-j6hq-p3gf-296j","CGA-rcfv-3vwx-gq5q","CGA-w6fx-4wqq-362x","CGA-wq55-vvw6-xhvm","GHSA-4w7w-66w2-5vf9","CGA-292h-5fp3-jc63","CGA-29m6-f25r-pmj2","CGA-2c8h-jqx9-64mr","CGA-2gcv-43vq-7fwq","CGA-2pwf-492v-hp2x","CGA-2w5p-xw8f-rfg8","CGA-2w9p-6j7p-vp3c","CGA-2x5m-f9gv-p85m","CGA-36cp-x44v-54jr","CGA-3h55-mrfw-rrxx","CGA-3pr8-ph6j-3xfh","CGA-3wrc-wpjv-f66w","CGA-3x9q-8qfr-mm4c","CGA-48jh-hq65-jq95","CGA-4pjv-whfj-qh8v","CGA-5fg9-4gff-xr77","CGA-5fp5-jhh7-cgv6","CGA-5hh9-vh88-gvpg","CGA-62xm-h489-m4hh","CGA-6chq-7p7m-fr38","CGA-6w52-3ccj-g82x","CGA-79mr-j37r-qw8j","CGA-7fx6-7ghh-4x62","CGA-7hmj-mv94-q2c6","CGA-7pmq-vph9-6q3w","CGA-7qhv-8473-c7jg","CGA-89jh-xqq3-c693","CGA-96xr-3fjv-3c5g","CGA-9f32-q4j5-qxg7","CGA-9jxv-xp73-752v","CGA-c2rj-2wjq-wpx3","CGA-c3h6-qcjw-hq68","CGA-c4w6-j8rq-qv6p","CGA-ccg6-wjj9-9j6f","CGA-cjw7-q3r2-fg25","CGA-cqpv-45c2-v993","CGA-cqvx-h52m-82jm","CGA-f53m-j53p-345v","CGA-fhcj-x5v8-pw24","CGA-frvj-6ffg-jr29","CGA-fwmh-4pxf-43h7","CGA-g6jh-cqfh-m889","CGA-g6w6-fv3c-jm4v","CGA-gcv3-fp4g-82g2","CGA-h35c-r8qh-hx5v","CGA-h378-784f-fr2v","CGA-h6gr-x5jf-783w","CGA-h96v-m687-4whg","CGA-h977-692v-wv2m","CGA-h982-38c2-74g6","CGA-h9mf-vgmg-xm9c","CGA-hf9c-57xx-4p5g","CGA-hg2h-wq68-v684","CGA-hp29-v6g4-g9qj","CGA-j4fv-3p4v-8fcw","CGA-j9v8-g324-cwc5","CGA-jh9h-gchr-88c6","CGA-jx58-mf5x-r6jp","CGA-m5xr-5f5f-8qw5","CGA-m8j4-2v44-7vmp","CGA-p6gm-m9xf-5fr3","CGA-qg3j-xv4h-g2hg","CGA-qjw2-4rw3-c49p","CGA-qpvh-5xxj-5fv7","CGA-r22w-rrcp-g26w","CGA-v6fv-h3xr-6mw5","CGA-v9vq-7586-jjpw","CGA-vvgq-48hw-r7gh","CGA-vvv4-rvxr-73wh","CGA-vw44-xv5x-m2w5","CGA-wfcf-mj54-35j9","CGA-wx82-rqw3-7x9q","CGA-xc9f-cx4h-279g","CGA-xm4h-5fx8-qjrr"],"status":"published","duplicateOf":null,"title":null,"description":"Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.","dates":{"published":"2026-04-07T19:13:50.927Z","modified":"2026-04-15T14:23:24.501Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.3,"severity":"medium","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Npm","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00982,"percentile":0.61714,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.068,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00914},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00914,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00914,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00914,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00914,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00914,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00914,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00914,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00914,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00914,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00914,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00982,"percentile":0.61714}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00914,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00914,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00914,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00914,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00982,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00982,"percentile":0.61714}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_VITEJS_VITE","name":"Vite","source":"github","url":"https://github.com/vitejs/vite/issues/8498","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.1","name":"commercial-gitlab-rails-ee-19.1","label":"commercial-gitlab-rails-ee-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.1","purlType":"apk","versions":[{"text":"< 19.1.7-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.7-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.2","name":"commercial-gitlab-rails-ee-19.2","label":"commercial-gitlab-rails-ee-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.2","purlType":"apk","versions":[{"text":"< 19.2.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.7-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.3","name":"commercial-gitlab-rails-ee-19.3","label":"commercial-gitlab-rails-ee-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.3","purlType":"apk","versions":[{"text":"< 19.3.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.4","name":"commercial-gitlab-rails-ee-19.4","label":"commercial-gitlab-rails-ee-19.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.4","purlType":"apk","versions":[{"text":"< 19.4.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.4.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.1","name":"commercial-gitlab-rails-ee-fips-19.1","label":"commercial-gitlab-rails-ee-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.2","name":"commercial-gitlab-rails-ee-fips-19.2","label":"commercial-gitlab-rails-ee-fips-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.2","purlType":"apk","versions":[{"text":"< 19.2.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.7-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.3","name":"commercial-gitlab-rails-ee-fips-19.3","label":"commercial-gitlab-rails-ee-fips-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.3","purlType":"apk","versions":[{"text":"< 19.3.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.4","name":"commercial-gitlab-rails-ee-fips-19.4","label":"commercial-gitlab-rails-ee-fips-19.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.4","purlType":"apk","versions":[{"text":"< 19.4.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.4.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.1","name":"gitlab-rails-ce-18.1","label":"gitlab-rails-ce-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.10","name":"gitlab-rails-ce-18.10","label":"gitlab-rails-ce-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.11","name":"gitlab-rails-ce-18.11","label":"gitlab-rails-ce-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.11","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.5","name":"gitlab-rails-ce-18.5","label":"gitlab-rails-ce-18.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.5","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.6","name":"gitlab-rails-ce-18.6","label":"gitlab-rails-ce-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.7","name":"gitlab-rails-ce-18.7","label":"gitlab-rails-ce-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.8","name":"gitlab-rails-ce-18.8","label":"gitlab-rails-ce-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.9","name":"gitlab-rails-ce-18.9","label":"gitlab-rails-ce-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.0","name":"gitlab-rails-ce-19.0","label":"gitlab-rails-ce-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.1","name":"gitlab-rails-ce-19.1","label":"gitlab-rails-ce-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.1","purlType":"apk","versions":[{"text":"< 19.1.2-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.2-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.1","name":"gitlab-rails-ce-fips-18.1","label":"gitlab-rails-ce-fips-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.10","name":"gitlab-rails-ce-fips-18.10","label":"gitlab-rails-ce-fips-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.10","purlType":"apk","versions":[{"text":"< 18.10.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.10.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.11","name":"gitlab-rails-ce-fips-18.11","label":"gitlab-rails-ce-fips-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.11","purlType":"apk","versions":[{"text":"< 18.11.12-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.11.12-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.5","name":"gitlab-rails-ce-fips-18.5","label":"gitlab-rails-ce-fips-18.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.5","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.6","name":"gitlab-rails-ce-fips-18.6","label":"gitlab-rails-ce-fips-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.7","name":"gitlab-rails-ce-fips-18.7","label":"gitlab-rails-ce-fips-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.8","name":"gitlab-rails-ce-fips-18.8","label":"gitlab-rails-ce-fips-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.9","name":"gitlab-rails-ce-fips-18.9","label":"gitlab-rails-ce-fips-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.9","purlType":"apk","versions":[{"text":"< 18.9.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.0","name":"gitlab-rails-ce-fips-19.0","label":"gitlab-rails-ce-fips-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.0","purlType":"apk","versions":[{"text":"< 19.0.9-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.0.9-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.1","name":"gitlab-rails-ce-fips-19.1","label":"gitlab-rails-ce-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.1","purlType":"apk","versions":[{"text":"< 19.1.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.2","name":"gitlab-rails-ce-fips-19.2","label":"gitlab-rails-ce-fips-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.2","purlType":"apk","versions":[{"text":"< 19.2.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-2-worker","name":"langfuse-2-worker","label":"langfuse-2-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-2-worker","purlType":"apk","versions":[{"text":"< 2.95.12-r19","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r19","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.164.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.164.0-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-2-worker","name":"langfuse-fips-2-worker","label":"langfuse-fips-2-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-2-worker","purlType":"apk","versions":[{"text":"< 2.95.12-r22","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r22","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3-worker","name":"langfuse-fips-3-worker","label":"langfuse-fips-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3-worker","purlType":"apk","versions":[{"text":"< 3.164.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.164.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3.152-worker","name":"langfuse-fips-3.152-worker","label":"langfuse-fips-3.152-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3.152-worker","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vite","name":"vite","label":"vite","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vite","purlType":"apk","versions":[{"text":"< 8.0.11-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.0.11-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-21","name":"vitess-21","label":"vitess-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-21","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-22","name":"vitess-22","label":"vitess-22","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-22","purlType":"apk","versions":[{"text":"< 22.0.4-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 22.0.4-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-23","name":"vitess-23","label":"vitess-23","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-23","purlType":"apk","versions":[{"text":"< 23.0.3-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.0.3-r11","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.164.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.164.0-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vite","name":"vite","label":"vite","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vite","purlType":"apk","versions":[{"text":"< 8.0.11-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.0.11-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vitess-23","name":"vitess-23","label":"vitess-23","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vitess-23","purlType":"apk","versions":[{"text":"< 23.0.3-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.0.3-r11","eol":null,"hubHref":null},{"vendor":"Npm","product":"vite","name":"vite","label":"vite","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/vite","purlType":"npm","versions":[{"text":"≥ 8.0.0, < 8.0.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.3.2","noFixRecorded":false,"fixedIn":null},{"text":"< 6.4.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 8.0.0, < 8.0.5 | ≥ 7.0.0, < 7.3.2 | < 6.4.2","eol":null,"hubHref":null},{"vendor":"vitejs","product":"vite","name":"vite","label":"vite","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 8.0.0, < 8.0.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.3.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0.0, < 6.4.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0.0, ≤ 6.4.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, ≤ 7.3.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, ≤ 8.0.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 8.0.0, < 8.0.5 | ≥ 7.0.0, < 7.3.2 | ≥ 6.0.0, < 6.4.2 | ≥ 6.0.0, ≤ 6.4.1 | ≥ 7.0.0, ≤ 7.3.1 | ≥ 8.0.0, ≤ 8.0.4","eol":null,"hubHref":"/vendor/vitejs/vite"},{"vendor":"vitejs","product":"vite-plus","name":"vite-plus","label":"vite-plus","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.1.16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.1.16","eol":null,"hubHref":"/vendor/vitejs/vite-plus"},{"vendor":"voidzero","product":"vite\\+","name":"vite\\+","label":"vite\\+","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 0.1.15","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 0.1.15","eol":null,"hubHref":"/vendor/voidzero/vite"}],"affectedCount":45,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9","label":"github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB","Exploit","Vendor Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39365.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39365.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39365","label":"nvd.nist.gov/vuln/detail/CVE-2026-39365","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/vitejs/vite/pull/22161","label":"github.com/vitejs/vite/pull/22161","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694","label":"github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/vitejs/vite","label":"github.com/vitejs/vite","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/vitejs/vite/releases/tag/v6.4.2","label":"github.com/vitejs/vite/releases/tag/v6.4.2","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/vitejs/vite/releases/tag/v7.3.2","label":"github.com/vitejs/vite/releases/tag/v7.3.2","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/vitejs/vite/releases/tag/v8.0.5","label":"github.com/vitejs/vite/releases/tag/v8.0.5","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-V8CR-XQ93-34HX"]},"timeline":[{"kind":"published","date":"2026-04-07T19:13:50.927Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-15T14:23:24.501Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":35,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T10:36:34.476Z","stale":false,"partial":false}}