CVE-2026-39363 Details
Description
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "..."). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
A vulnerability in Vite, a frontend tooling framework for JavaScript, allows for arbitrary file reading through the dev server's WebSocket. This issue affects Vite versions 6.0.0 prior to 6.4.2, 7.0.0 prior to 7.3.1, and 8.0.0 prior to 8.0.5. The vulnerability arises when the dev server is exposed to the network without an Origin header, enabling an attacker to use the WebSocket event 'vite:invoke' to access file contents as a JavaScript string. Notably, the access controls applied to HTTP requests are bypassed in this WebSocket execution path.
Users can update to Vite versions 6.4.2, 7.3.2, or 8.0.5 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:24761 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:24762 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:24866 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:59153 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-39363 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2456179 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39363.json | redhat-SADP | |
| https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1220 | Insufficient Granularity of Access Control | redhat-SADP |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vitejs vite | >= 6.0.0, <= 6.4.1 >= 7.0.0, <= 7.3.1 >= 8.0.0, <= 8.0.4 |
CPE
Remediation
| |
| voidzero vite+ | <= 0.1.15 |
CPE
Remediation
| |
Change History
11 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 25, 2026 | CVE Modified | redhat-SADP |
| Aug 4, 2026 | CVE Modified | redhat-SADP |
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 30, 2026 | Reanalysis | [email protected] |
| Apr 15, 2026 | Initial Analysis | [email protected] |
| Apr 8, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | New CVE Received | [email protected] |