Is CVE-2026-39364 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39364 being exploited in the wild.

How severe is CVE-2026-39364?

High severity, with a CVSS score of 7.5, published 7 April 2026.

Which products and versions are affected?

Vite SEMVER:introduced=8.0.0,fixed=8.0.5.

Is there a fix for CVE-2026-39364?

Yes. Vite: upgrade to 8.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39364 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-39364?

Check whether you run Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39364: Vite information disclosure via query parameter manipulation in dev server

CVE-2026-39364 · Severity: high · CVSS 7.5 · Published 2026-04-07

Vite is a popular development tool used by software engineers to build and test JavaScript applications. A security flaw in its development server allows unauthorized users to bypass access restrictions and view sensitive files, such as environment variables (.env) or security certificates (.crt), by simply adding specific text to a web address. This could lead to the exposure of private credentials or configuration data if the development server is accessible over a network.

Technologies: Vite.

Quick answers

Is CVE-2026-39364 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39364 being exploited in the wild.
How severe is CVE-2026-39364?: High severity, with a CVSS score of 7.5, published 7 April 2026.
Which products and versions are affected?: Vite SEMVER:introduced=8.0.0,fixed=8.0.5.
Is there a fix for CVE-2026-39364?: Yes. Vite: upgrade to 8.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39364 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-39364?: Check whether you run Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Vite: upgrade to 8.0.5 or later

Technical details

An information disclosure vulnerability exists in the Vite development server due to improper handling of query parameters. Files that are explicitly restricted via the 'server.fs.deny' configuration (such as .env or *.crt) can be retrieved with an HTTP 200 response if an attacker appends query parameters like '?raw', '?import&raw', or '?import&url&inline' to the request URL. This bypass occurs because the server validates the file path before canonicalizing or processing these specific Vite-internal query parameters. The vulnerability is exploitable if the dev server is exposed to the network (e.g., via --host) and the target files reside within the 'server.fs.allow' path. The issue is fixed in Vite versions 7.3.2 and 8.0.5.

Affected products

vitejs Vite >= 7.1.0, < 7.3.2; >= 8.0.0, < 8.0.5
vitejs Vite-plus <= 0.1.15
Red Hat Ansible Automation Platform 2.6 Affected
Red Hat OpenShift Container Platform 4 Affected

Identifiers

CVE-2026-39364
GHSA-v2wj-q39q-566r

Timeline

2026-04-06: advisory: GitHub Security Advisory published by vitejs
2026-04-07: disclosed: CVE-2026-39364 published to NVD
2026-06-09: patched: Red Hat released security updates for Ansible Automation Platform

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.