LiveActive security incident?Get immediate response
CVE Record

CVE-2026-39363: Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "..."). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.

HighCVSS 8.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Affected Vite development servers can disclose arbitrary server files to an unauthenticated attacker through a WebSocket path that bypasses normal file-access restrictions. Secrets, source code, configuration, and credentials stored on the development host may be exposed if an attacker can reach the vulnerable WebSocket endpoint.

Executive priority

Treat reachable vulnerable development servers as a high-priority confidentiality risk. Patch internet-accessible or shared-environment instances immediately, then complete an organization-wide dependency inventory. Investigate and rotate secrets where exposure is plausible. Isolated development systems remain important but can follow after externally reachable instances.

Technical view

Vite 6.0.0–6.4.1, 7.0.0–7.3.1, and 8.0.0–8.0.4 permit an Origin-less WebSocket client to invoke module fetching and read arbitrary files. The WebSocket execution path does not enforce HTTP-path controls such as server.fs.allow. Vite Plus versions before 0.1.16 are also listed as affected.

Likely exposure

Exposure requires an affected Vite or Vite Plus development server whose WebSocket is reachable by an untrusted party and accepts connections without an Origin header. Internet-exposed, shared-network, containerized, or remotely accessible development environments deserve immediate review. Production static Vite builds are not identified as affected by the supplied evidence.

Exploitation context

The issue is remotely reachable, unauthenticated, low complexity, and primarily threatens confidentiality, with CVSS 4.0 score 8.2. A specific prerequisite applies: the attacker must connect to the development server WebSocket without an Origin header. The supplied record is not in KEV and provides no evidence of active exploitation.

Researcher notes

The security boundary failure is path-specific: HTTP file restrictions are not applied to WebSocket-triggered module fetching. Assessment should distinguish live development servers from generated production assets and confirm both version and WebSocket reachability. The supplied sources establish disclosure impact and fixes, but do not establish exploitation in the wild.

Mitigation direction

  • Upgrade Vite 6.x to 6.4.2 or later.
  • Upgrade Vite 7.x to 7.3.2 or later.
  • Upgrade Vite 8.x to 8.0.5 or later.
  • Upgrade Vite Plus to 0.1.16 or later.
  • Until upgraded, restrict development-server and WebSocket access to trusted users and networks.
  • Rotate exposed secrets if logs or investigation indicate unauthorized file access.

Validation and detection

  • Inventory Vite and Vite Plus versions in manifests, lockfiles, build images, and developer environments.
  • Identify development servers reachable from public, shared, or otherwise untrusted networks.
  • Confirm deployed Vite versions meet the fixed release for their major version.
  • Verify the WebSocket endpoint rejects unauthorized Origin-less connections after remediation.
  • Review development-host telemetry for unexpected WebSocket connections or sensitive file retrieval activity.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-1220: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · medium confidence lookup

CWE-200: Information exposure and cloud metadata lookup

Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · medium confidence lookup

CWE-306: Credential and account abuse lookup

Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

File access behavior lookup

The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-39363 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.2 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
5Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: yesTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.2CVSS 4.0HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N——GitHub_M
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6redhat-SADP

Vulnerability scoring details

Base CVSS 4.0 score

8.2High
CVSS 4.0 vector shape for CVE-2026-39363Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. ADP timelineredhat-SADP

    Made public.

  3. CVE publishedCVE Program

    The CVE record was published.

  4. ADP timelineredhat-SADP

    Reported to Red Hat.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
redhat-SADPVite: Vite: Information disclosure via WebSocket connection bypasses access control
other:Red Hat severity ratingcvssV3_1
  • 2026-04-07T20:02:11.316Z: Reported to Red Hat.
  • 2026-04-07T19:10:44.916Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
vitejsvite>= 8.0.0, < 8.0.5, >= 7.0.0, < 7.3.2, >= 6.0.0, < 6.4.2Listed
vitejsvite-plus< 0.1.16Listed
Weakness

CWE details

CWE-1220CWE-200CWE-306

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.