Incorrect Behavior Order: Validate Before Canonicalize Affecting vite-plus package, versions <0.1.16
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-VITEPLUS-15922246
- published7 Apr 2026
- disclosed6 Apr 2026
- creditodgrso, Ritik Chaddha, neo-ai-engineer, instantraaamen, fg0x0, jonathanwd, kq5y
Introduced: 6 Apr 2026
NewCVE-2026-39364 (opens in a new tab)How to fix?
Upgrade vite-plus to version 0.1.16 or higher.
Overview
vite-plus is a The Unified Toolchain for the Web
Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize through the server.fs.deny component. An attacker can access sensitive files by appending specific query parameters such as ?raw, ?import&raw, or ?import&url&inline to HTTP requests.
Note:
This is only exploitable if the development server is explicitly exposed to the network, the sensitive file exists within directories allowed by server.fs.allow, and the file is denied by a pattern in server.fs.deny.