Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-04-07T19:13:50 vite: Vite: Information disclosure via path traversal in dev server's .map request handling 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-22

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.

A flaw was found in Vite. The development server's handling of `.map` requests contains a path traversal vulnerability. A remote attacker can exploit this by sending a specially crafted request with directory traversal sequences (`../`) to bypass security restrictions. This allows the attacker to retrieve `.map` files located outside the project's intended directory, leading to information disclosure.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Advanced Cluster Security 4 Fix deferred rhacs-eng/release-main Red Hat Ansible Automation Platform 2 Fix deferred automation-controller Red Hat Ansible Automation Platform 2 Fix deferred automation-eda-controller Red Hat Ansible Automation Platform 2 Fix deferred automation-gateway Red Hat Ansible Automation Platform 2 Fix deferred automation-platform-ui Red Hat Ansible Automation Platform 2 Fix deferred redhat-user-workloads/gateway-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred redhat-user-workloads/mcp-server-rhel9 Red Hat Build of Keycloak Fix deferred vite Red Hat Build of Podman Desktop Fix deferred podman-desktop-macos-1-0 Red Hat Build of Podman Desktop Fix deferred podman-desktop-windows-1-0 Red Hat Build of Podman Desktop - Tech Preview Fix deferred redhat-user-workloads/bootc-ext Red Hat Build of Podman Desktop - Tech Preview Fix deferred redhat-user-workloads/openshift-local-ext Red Hat Build of Podman Desktop - Tech Preview Fix deferred redhat-user-workloads/rhel-ext Red Hat JBoss Enterprise Application Platform 8 Fix deferred vite Red Hat JBoss Enterprise Application Platform Expansion Pack Fix deferred vite Red Hat OpenShift Container Platform 4 Fix deferred redhat-user-workloads/art-images https://www.cve.org/CVERecord?id=CVE-2026-39365 https://nvd.nist.gov/vuln/detail/CVE-2026-39365 https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9