CVE-2026-39365: 
JavaScript vulnerability analysis and mitigation

CVE-2026-39365 is a path traversal vulnerability in the Vite JavaScript frontend tooling framework's dev server, specifically in its handling of .map requests for optimized dependencies. The dev server resolves file paths and calls readFile without restricting ../ segments in the URL, allowing attackers to bypass the server.fs.strict allow list and retrieve .map files located outside the project root. Affected versions include Vite 6.0.0–6.4.1, 7.0.0–7.3.1, and 8.0.0–8.0.4, as well as vite-plus ≤0.1.15. The vulnerability was published on April 6, 2026, and has a CVSS v4 base score of 6.3 (Medium) (GitHub Advisory, Github Advisory).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22) combined with exposure of sensitive information to an unauthorized actor (CWE-200). When the Vite dev server handles requests for .map files associated with optimized dependencies, it constructs a file path from the URL and calls readFile without sanitizing or blocking ../ traversal sequences, effectively bypassing the server.fs.strict allow list security control. Exploitation requires no authentication or user interaction, but does require that the Vite dev server is explicitly exposed to the network via --host or the server.host configuration option, and that the target .map file outside the project root can be parsed as valid source map JSON. A public proof-of-concept is included in the official security advisory, detailing how to craft a path traversal URL under the optimized deps .map URL prefix to reach arbitrary .map files on the filesystem (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary .map files located outside the Vite project root, potentially disclosing sensitive source code, internal file structure, or other confidential information embedded in source map files. There is no impact on integrity or availability; the vulnerability is limited to confidentiality. The risk is highest in development environments where the Vite dev server is network-exposed and sensitive .map files with predictable paths exist on the host filesystem (GitHub Advisory, Github Advisory).

A proof-of-concept exploit is publicly available in the official Vite security advisory, with step-by-step reproduction instructions rated as high confidence by Feedly threat intelligence. As of the time of reporting, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 1.457% (81st percentile), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Nuclei detection templates have been added to the ProjectDiscovery nuclei-templates repository, facilitating automated scanning (GitHub Advisory, Github Advisory).

1. Reconnaissance: Identify internet- or network-exposed Vite dev server instances (running with --host or server.host configured) using network scanning tools such as Shodan, Censys, or Nuclei templates targeting Vite dev server fingerprints.
2. Identify target file: Determine a predictable path to a sensitive .map file outside the Vite project root on the target host (e.g., /tmp/poc.map or application-specific source maps).
3. Craft path traversal URL: Construct a URL that uses the optimized dependencies .map URL prefix and injects ../ segments to traverse outside the project root. For example:

   GET /node_modules/.vite/deps/some-dep.js.map?../../../../tmp/poc

   or by injecting ../ sequences directly in the path under the optimized deps .map URL prefix.
4. Send request: Issue the crafted HTTP GET request to the Vite dev server. The server resolves the path without sanitizing traversal segments and calls readFile on the resulting path.
5. Retrieve file contents: If the target file exists and can be parsed as valid source map JSON, the server returns its contents to the attacker, disclosing potentially sensitive source code or configuration data (GitHub Advisory).

• Network: Unusual HTTP GET requests to Vite dev server endpoints containing ../ or URL-encoded path traversal sequences (e.g., %2e%2e%2f) in .map request URLs; requests to optimized dependency .map paths that reference locations outside the project root.
• Logs: Vite dev server access logs showing requests to .map endpoints with anomalous path segments such as ../../, particularly targeting paths outside the project directory; repeated requests to .map URLs with varying traversal depths suggesting automated scanning.
• File System: No direct file system artifacts are created by exploitation, as the attack is read-only; however, unexpected access patterns to .map files outside the project root may be observable in OS-level file access auditing (e.g., auditd on Linux).
• Process: No unusual child processes are expected, as exploitation is limited to file read operations via the Vite dev server process (GitHub Advisory).

Upgrade Vite to the patched versions: 6.4.2, 7.3.2, or 8.0.5 (depending on the major version in use); vite-plus users should upgrade to 0.1.16. IBM API Connect users should refer to the IBM advisory for applicable patches. If immediate upgrade is not possible, restrict network access to the Vite dev server by not using --host or server.host options, ensuring the dev server is only accessible on localhost. Additionally, avoid storing sensitive content in .map files at predictable paths on the host filesystem (GitHub Advisory, IBM Advisory).

The vulnerability was reported by security researchers odgrso and Ochk0, with remediation review by Vite maintainer bluwy, and was published via the official Vite GitHub security advisory. Red Hat tracked the issue via Bugzilla (Bug 2456190) and IBM issued an advisory for affected API Connect products. The ProjectDiscovery team added multiple Nuclei detection templates shortly after disclosure, indicating active community interest in automated detection. Social media activity was limited but present, with at least one post on Bluesky referencing the CVE (GitHub Advisory, Red Hat Bugzilla, IBM Advisory).