CVE-2026-39363 — Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

Description (CNA)

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "..."). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.

Affected (CNA)

Vendor / product	Versions
vitejs / vite	affected >= 8.0.0, < 8.0.5; affected >= 7.0.0, < 7.3.2; affected >= 6.0.0, < 6.4.2
vitejs / vite-plus	affected < 0.1.16

CWE

CWE-200, CWE-306

References

https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583

redhat-SADP

A flaw was found in Vite, a frontend tooling framework. A remote attacker can exploit this vulnerability by connecting to the Vite development server's WebSocket without an Origin header. This allows the attacker to invoke the fetchModule function, enabling them to retrieve the contents of arbitrary files on the server. This information disclosure can lead to unauthorized access to sensitive data.