Описание
Vite Vulnerable to Path Traversal in Optimized Deps .map Handling
Summary
Any files ending with .map even out side the project can be returned to the browser.
Impact
Only apps that match the following conditions are affected:
- explicitly exposes the Vite dev server to the network (using
--hostorserver.hostconfig option) - have a sensitive content in files ending with
.mapand the path is predictable
Details
In Vite v7.3.1, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON.
PoC
- Create a minimal PoC sourcemap outside the project root
cat > /tmp/poc.map <<'EOF' {"version":3,"file":"x.js","sources":[],"names":[],"mappings":""} EOF
- Start the Vite dev server (example)
pnpm -C playground/fs-serve dev --host 127.0.0.1 --port 18080
- Confirm that direct
/@fsaccess is blocked bystrict(returns 403) - Inject
../segments under the optimized deps.mapURL prefix to reach/tmp/poc.map
Ссылки
- https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9
- https://nvd.nist.gov/vuln/detail/CVE-2026-39365
- https://github.com/vitejs/vite/pull/22161
- https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694
- https://github.com/vitejs/vite/releases/tag/v6.4.2
- https://github.com/vitejs/vite/releases/tag/v7.3.2
- https://github.com/vitejs/vite/releases/tag/v8.0.5
Пакеты
vite
>= 8.0.0, <= 8.0.4
8.0.5
vite
>= 7.0.0, <= 7.3.1
7.3.2
vite
<= 6.4.1
6.4.2
Связанные уязвимости
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to bef ...
Уязвимость локального сервера разработки приложений Vite и Vite+, связанная с неверным ограничением имени пути к каталогу, позволяющая нарушителю раскрыть защищаемую информацию