advisory-database/advisories/github-reviewed/2026/04/GHSA-4w7w-66w2-5vf9/GHSA-4w7w-66w2-5vf9.json at 3ff3905f02026f9dda4793ef40c0df0014e1b0f0 · github/advisory-database · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
{
  "schema_version": "1.4.0",
  "id": "GHSA-4w7w-66w2-5vf9",
  "modified": "2026-04-07T22:16:29Z",
  "published": "2026-04-06T18:03:46Z",
  "aliases": [
    "CVE-2026-39365"
  ],
  "summary": "Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
  "details": "const axios = require('axios');\n// Simple check to see if your ECE Wallet dependencies are up to date\nasync function checkDependencies() {\n    const response = await axios.get('https://registry.npmjs.org/@telegram-apps/sdk-react/latest');\n    console.log(`Latest SDK Version: ${response.data.version}`);\n}\ncheckDependencies();\n",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.5"
            }
          ]
        }
      ],
      "database_specific": {
        "last_known_affected_version_range": "<= 8.0.4"
      }
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.3.2"
            }
          ]
        }
      ],
      "database_specific": {
        "last_known_affected_version_range": "<= 7.3.1"
      }
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.4.2"
            }
          ]
        }
      ],
      "database_specific": {
        "last_known_affected_version_range": "<= 6.4.1"
      }
    }
  ],
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39365"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/pull/22161"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vitejs/vite"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/releases/tag/v6.4.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/releases/tag/v7.3.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/releases/tag/v8.0.5"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-22"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-06T18:03:46Z",
    "nvd_published_at": "2026-04-07T20:16:30Z"
  }
}