CVE-2026-39363
1 advisory.
npm/vite CVE-2026-39363: high, EPSS 2.62%
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
Action: Upgrade vite to 6.4.2 or later.
npm i vite@8.0.5npm i vite@7.3.2npm i vite@6.4.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.0.0 | 8.0.5 | - |
| 7.0.0 | 7.3.2 | - |
| 6.0.0 | 6.4.2 | - |
Fixed versions
| 8.0.5 | 7.3.2 | 6.4.2 |
Sources
- osv: GHSA-p9ff-h696-f583
- https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583
- https://nvd.nist.gov/vuln/detail/CVE-2026-39363
- https://github.com/vitejs/vite/pull/22159
- https://github.com/vitejs/vite/commit/f02d9fde0b195afe3ea2944414186962fbbe41e0
- https://github.com/vitejs/vite
- https://github.com/vitejs/vite/releases/tag/v6.4.2
- https://github.com/vitejs/vite/releases/tag/v7.3.2
- https://github.com/vitejs/vite/releases/tag/v8.0.5
CVE-2026-39363 · published · modified · JSON