CVE-2026-39365

CVE-2026-39365 is a path traversal vulnerability affecting Vite, a popular JavaScript frontend build tool, in versions 6.0.0 through 6.4.1, 7.0.0 through 7.3.1, and 8.0.0 through 8.0.4. The vulnerability exists in the development server's handling of .map file requests, where insufficient path validation allows attackers to use ../ directory traversal sequences to bypass the server.fs.strict allow list and read source map files outside the project root. The vulnerability carries a CVSS 3.1 severity score of 5.3 (Medium) with a network-based attack vector requiring no authentication or user interaction. However, successful exploitation is constrained by the requirement that accessed files must be valid JSON-formatted source maps, limiting the practical scope of exposure. The attack impacts confidentiality by potentially exposing sensitive information in source maps, though integrity and availability are not affected. There are no confirmed public exploits or active exploitation campaigns documented for this vulnerability. The KEV catalog does not list it as actively exploited in the wild, and it remains relatively low in community attention with an EPSS percentile score of only 0.79%, indicating minimal real-world prevalence. Organizations should apply the available patches (6.4.2, 7.3.2, or 8.0.5) during routine maintenance cycles rather than treating this as an urgent incident.