The vitejs vite dev server improperly restricts pathname resolution for .map requests related to optimized dependencies in versions 6.0.0 through before 6.4.2, 7.3.2, and 8.0.5. Specifically, it resolves file paths and reads files without properly limiting '../' segments in URLs, allowing path traversal outside the intended directory. This bypasses the server.fs.strict allow list and permits retrieval of .map files located outside the project root, provided the files can be parsed as valid source map JSON. The vulnerability is tracked as CVE-2026-39365 and is categorized under CWE-22. Official fixes were released in vite versions 6.4.2, 7.3.2, and 8.0.5.

An attacker can exploit this vulnerability to read .map files outside the project root directory on the development server. This could lead to unauthorized disclosure of source map files, which may contain sensitive information about the source code structure. The CVSS 4.0 score of 6.3 indicates a medium severity impact with network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality.

This vulnerability is fixed in vite versions 6.4.2, 7.3.2, and 8.0.5. Users should upgrade to one of these versions or later to remediate the issue. Since this is not a cloud service, remediation depends on applying the official patches. Patch status is confirmed by the vendor advisory indicating fixed versions. No additional mitigations are specified.