Description
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
vitejs vite
>= 8.0.0, < 8.0.5affected>= 7.1.0, < 7.3.2affected
vitejs vite-plus
< 0.1.16affected
References
- https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r ↗
- https://access.redhat.com/security/cve/CVE-2026-39364 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2456181 ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39364.json ↗
- https://access.redhat.com/errata/RHSA-2026:24866 ↗