CVE-2026-39364High· 7.5▾ MidnightPoC availableVite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query par…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
2.1%
Nuclei ×1
2.1% → 2.3%
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
vite >= 7.0.0, <= 7.3.1vite >= 8.0.0, <= 8.0.4vite+ <= 0.1.15Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118662MediumVite: `server.fs.deny` bypassed with queries
CVE-2026-112946Medium· 6.3Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
CVE-2026-39363High· 7.5Vite is a frontend tooling framework for JavaScript
CVE-2025-58752Medium· 5.3Vite is a frontend tooling framework for JavaScript
CVE-2026-112945Low· 2.1Vite: Cross origin script execution through Vite custom middleware
CVE-2026-53571Mediumvite: `server.fs.deny` bypass on Windows alternate paths