CVE-2026-393648.2HighCWE-180
Vite has a `server.fs.deny` bypass with queries
vitejs · vite
Not in CISA KEVFixed in version 7.3.2
2.3%probability of exploitation in the next 30 days
82nd percentile
050100
Higher than 82% of scored CVEs
8.2HighCVSS 4.0
LowMediumHighCrit.
DescriptionNVD
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
Coverage2 articles · 1 outlet
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 15 Sep.
Quiet for 6 weekslast report 21 Sep2 articles1 outlet
- Tue 15 Sep, 02:21 UTC. SecurityOnline, first report. Attackers Scan Vite Servers to Steal Cloud Credentials via CVE-2026-39364.
- Mon 21 Sep, 02:59 UTC. SecurityOnline. Cisco Warns of Actively Exploited Flaws Enabling Root Access.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 15 Sep 02:21 | SecurityOnline | Attackers Scan Vite Servers to Steal Cloud Credentials via CVE-2026-39364 |
| 21 Sep 02:59 | SecurityOnline | Cisco Warns of Actively Exploited Flaws Enabling Root Access |
- Cisco Warns of Actively Exploited Flaws Enabling Root AccessSecurityOnline · mentions it in passing
- Attackers Scan Vite Servers to Steal Cloud Credentials via CVE-2026-39364SecurityOnline · first in our coverage
New articles also arrive in the RSS feed.