CVE-2026-39363 Scanner
CVE-2026-39363 Scanner - Arbitrary File Read vulnerability in Vite Dev Server
Used 2.2k times · 3.4k assets checked · domain, subdomain, ipv4
CVE
CVE-2026-39363
8.2
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "..."). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
vitevite-plusred hat ansible automation platform 2.5 for rhel 8red hat ansible automation platform 2.5 for rhel 9red hat ansible automation platform 2.6 for rhel 9red hat ansible automation platform 2.6
Updated Oct 12, 2026View on NVD →
S4E scanner
CVE history: vite
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →