Executive brief
Vite is a popular development tool used by software engineers to build and test JavaScript applications. A security flaw in its development server allows unauthorized users to bypass access restrictions and view sensitive files, such as environment variables (.env) or security certificates (.crt), by simply adding specific text to a web address. This could lead to the exposure of private credentials or configuration data if the development server is accessible over a network.
Technical details
An information disclosure vulnerability exists in the Vite development server due to improper handling of query parameters. Files that are explicitly restricted via the 'server.fs.deny' configuration (such as .env or *.crt) can be retrieved with an HTTP 200 response if an attacker appends query parameters like '?raw', '?import&raw', or '?import&url&inline' to the request URL. This bypass occurs because the server validates the file path before canonicalizing or processing these specific Vite-internal query parameters. The vulnerability is exploitable if the dev server is exposed to the network (e.g., via --host) and the target files reside within the 'server.fs.allow' path. The issue is fixed in Vite versions 7.3.2 and 8.0.5.
Affected products
- vitejs Vite >= 7.1.0, < 7.3.2; >= 8.0.0, < 8.0.5
- vitejs Vite-plus <= 0.1.15
- Red Hat Ansible Automation Platform 2.6 Affected
- Red Hat OpenShift Container Platform 4 Affected
Timeline
- 2026-04-06: advisory: GitHub Security Advisory published by vitejs
- 2026-04-07: disclosed: CVE-2026-39364 published to NVD
- 2026-06-09: patched: Red Hat released security updates for Ansible Automation Platform