Is there a public PoC exploit available for CVE-2026-39364?

Yes, a public proof-of-concept exploit is available for CVE-2026-39364. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-39364?

Within 24 hours: identify all Vite installations via `npm list vite` across development and staging environments and document current versions. Within 7 days: upgrade all instances to vite@7.3.2 or vite@8.0.5 or later; verify dev servers are not network-exposed (restrict to localhost/127.0.0.1 only) and conduct immediate audit of server logs for suspicious ?raw, ?import&raw, or ?import&url&inline query parameters indicating exploitation attempts. Within 30 days: rotate all .env secrets, API keys, and certificates that may have existed in accessible directories during the vulnerable period; implement network segmentation to prevent dev server exposure.

CVE-2026-39364

Q: What is the CVSS score of CVE-2026-39364?

CVE-2026-39364 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19873 HIGH

Incorrect Behavior Order: Validate Before Canonicalize (CWE-180)

2026-04-06 https://github.com/vitejs/vite

GHSA-v2wj-q39q-566r

Information Disclosure

8.2

CVSS 4.0 · Vendor: https://github.com/vitejs/vite

Severity by source

Vendor (https://github.com/vitejs/vite) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (https://github.com/vitejs/vite).

CVSS VectorVendor: https://github.com/vitejs/vite

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 08, 2026 - 21:27 vuln.today

Public exploit code

EUVD ID Assigned

Apr 07, 2026 - 14:30 euvd

EUVD-2026-19873

Analysis Generated

Apr 07, 2026 - 14:30 vuln.today

Patch released

Apr 07, 2026 - 14:30 nvd

Patch available

CVE Published

Apr 06, 2026 - 18:03 nvd

HIGH 8.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

34 npm packages depend on vite (30 direct, 4 indirect)

Ecosystem-wide dependent count for version 8.0.0.

DescriptionCVE.org

Summary

The contents of files that are specified by server.fs.deny can be returned to the browser.

Impact

Only apps that match the following conditions are affected:

explicitly exposes the Vite dev server to the network (using --host or server.host config option)
the sensitive file exists in the allowed directories specified by server.fs.allow
the sensitive file is denied with a pattern that matches a file by server.fs.deny

Details

On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended.

PoC

Start the dev server: pnpm exec vite root --host 127.0.0.1 --port 5175 --strictPort
Confirm that server.fs.deny is enforced (expect 403): curl -i http://127.0.0.1:5175/src/.env | head -n 20

Confirm that the same files can be retrieved with query parameters (expect 200):

AnalysisAI

Vite development server allows unauthorized file disclosure by bypassing server.fs.deny restrictions when specific query parameters (?raw, ?import&raw, ?import&url&inline) are appended to file requests. The npm package 'vite' is affected when the dev server is explicitly exposed to the network and sensitive files exist within allowed directories but are supposedly blocked by deny patterns. A publicly available exploit code exists demonstrating retrieval of .env files and certificates. Fixed in versions 7.3.2 and 8.0.5 according to vendor release tags.

Technical ContextAI

Vite is a modern frontend build tool and development server for JavaScript applications. The vulnerability affects the dev server's file system access control mechanism, specifically the server.fs.deny configuration option designed to block access to sensitive files like environment variables (.env) and certificates (*.crt). The root cause is CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize), where the server's query parameter handling logic processes special directives (?raw, ?import&raw, ?import&url&inline) before enforcing filesystem deny rules. This allows attackers to bypass the deny list by appending these parameters to file paths, causing the server to return HTTP 200 responses with file contents instead of the expected HTTP 403 forbidden responses. The vulnerability exists in the npm package 'vite' as identified by CPE pkg:npm/vite, affecting the development server component specifically when configured with network exposure via --host flag or server.host configuration.

RemediationAI

Upgrade to Vite version 7.3.2 or later for the 7.x series, or version 8.0.5 or later for the 8.x series. The upstream fix is implemented in GitHub pull request #22160 (https://github.com/vitejs/vite/pull/22160) and commit a9a3df299378d9cbc5f069e3536a369f8188c8ff. Organizations using npm should update their package.json dependency to specify vite version ^7.3.2 or ^8.0.5 and run npm update or npm install to apply the patch. As a temporary workaround until patching is complete, avoid exposing Vite dev servers to network access by removing the --host flag or server.host configuration option, restricting dev server access to localhost only. Additionally, review server.fs.allow and server.fs.deny configurations to ensure sensitive files are not located within allowed directory trees. The complete security advisory with additional context is available at https://github.com/advisories/GHSA-v2wj-q39q-566r.