# CVE-2026-39365: Vite path traversal in optimized dependency map handling

Source: https://junglewise.ai/threats/cve-2026-39365-vite-path-traversal-in-optimized-dependency-map-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-39365 · Severity: medium · CVSS 5.3 · Published 2026-04-07

Vite is a popular build tool and development server used by web developers. When the dev server is exposed to the network, an attacker can bypass security restrictions and retrieve sensitive source map files (.map) from outside the project directory by injecting path traversal sequences into source map requests. This could expose source code or other sensitive information embedded in these files.

Technologies: [vite-plus (npm)](https://junglewise.ai/threats/technologies/vite-plus). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-39365 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39365 being exploited in the wild.

**How severe is CVE-2026-39365?** Medium severity, with a CVSS score of 5.3, published 7 April 2026.

**Which products and versions are affected?** vite-plus (npm) 0.1.15 and earlier.

**Is there a fix for CVE-2026-39365?** A patch was published on 2026-04-06: Patches released: Vite 6.4.2, 7.3.2, 8.0.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39365 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39365?** Check whether you run vite-plus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal (CWE-22) and information disclosure (CWE-200) flaw in Vite's dev server middleware that processes .map requests for optimized dependencies. The vulnerable component resolves file paths from URLs and calls readFile without restricting ../ segments, allowing attackers to escape the project root. Attack vector is network-based and requires no authentication or user interaction, but does require two preconditions: (1) the dev server must be explicitly exposed to the network via --host or server.host configuration, and (2) sensitive .map files with predictable paths must exist outside the project. An attacker can craft requests to /@vite-optimized-deps/<relative-path>/.map with traversal sequences to read arbitrary .map files. Patches are available in versions 6.4.2, 7.3.2, and 8.0.5.

## Affected products

- Vite Vite 6.4.1 and earlier, 7.0.0 through 7.3.1, 8.0.0 through 8.0.4
- npm vite-plus 0.1.15 and earlier

## Identifiers

- CVE-2026-39365
- GHSA-4w7w-66w2-5vf9

## Timeline

- 2026-04-06: disclosed: Vulnerability disclosed via GitHub Advisory GHSA-4w7w-66w2-5vf9
- 2026-04-06: patched: Patches released: Vite 6.4.2, 7.3.2, 8.0.5

## References

- [https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9](https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9)
- [https://github.com/vitejs/vite/pull/22161](https://github.com/vitejs/vite/pull/22161)
- [https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694](https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694)
- [https://github.com/vitejs/vite](https://github.com/vitejs/vite)
- [https://github.com/vitejs/vite/releases/tag/v6.4.2](https://github.com/vitejs/vite/releases/tag/v6.4.2)
- [https://github.com/vitejs/vite/releases/tag/v7.3.2](https://github.com/vitejs/vite/releases/tag/v7.3.2)

## Related threats

- [Vitest filesystem deny misapplication in dev servers](https://junglewise.ai/threats/cve-2026-112948-vitest-is-a-testing-framework-powered-by-vite-from-5-0-0-beta-6)
- [Vite information disclosure via WebAssembly query parameter](https://junglewise.ai/threats/cve-2026-112947-vite-is-a-frontend-tooling-framework-for-javascript-from-8-2-0)
- [Vite import analysis filesystem disclosure](https://junglewise.ai/threats/cve-2026-112946-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)
- [Vite path traversal in transformIndexHtml](https://junglewise.ai/threats/cve-2026-112945-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)
- [launch-editor command injection in editor invocation](https://junglewise.ai/threats/cve-2026-112944-launch-editor-allows-users-to-open-files-with-line-numbers-in)