CVE-2026-39364
Published: 07 April 2026
Summary
CVE-2026-39364 is a high-severity Incorrect Behavior Order: Validate Before Canonicalize (CWE-180) vulnerability in Vitejs Vite. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
Vite is a frontend tooling framework for JavaScript whose development server is affected by CVE-2026-39364. In versions 7.1.0 through versions prior to 7.3.2 and 8.0.5, the server.fs.deny mechanism can be bypassed, allowing files such as .env or *.crt to be returned with HTTP 200 responses when requests include query parameters such as ?raw, ?import&raw, or ?import&url&inline. The issue is tracked under CWE-180 and CWE-284 and carries a CVSS 4.0 score of 8.2.
An unauthenticated attacker with network access to an exposed Vite development server can exploit the flaw to retrieve sensitive files that the deny list is intended to block, resulting in high confidentiality impact without requiring user interaction.
The referenced GitHub Security Advisory states that the vulnerability is fixed in Vite 7.3.2 and 8.0.5; practitioners should upgrade affected installations to one of these releases to restore the intended file-access restrictions. The associated EPSS score has remained low, moving only from 0.0515 currently to a peak of 0.0683.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19873
Vulnerability details
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters…
more
such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote exploitation of an exposed Vite dev server (public-facing application) to bypass file access controls and retrieve sensitive local files like .env and private keys, directly mapping to T1190 for the exploitation vector and T1005 for unauthorized data collection from the local system.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely identification, reporting, and correction of the Vite dev server flaw enabling bypass of server.fs.deny restrictions via crafted query parameters.
Enforces approved authorizations for file access, directly countering the improper access control that allows retrieval of blocked files like .env and *.crt despite deny configurations.
Validates HTTP query parameters such as ?raw or ?import&raw to prevent early validation bypasses leading to unauthorized sensitive file disclosure.