CVE-2026-39363: Vite Vite Vulnerable To Arbitrary File Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-p9ff-h696-f583",
  "modified" : "2026-04-07T22:16:11Z",
  "published" : "2026-04-06T18:03:24Z",
  "aliases" : [ "CVE-2026-39363" ],
  "summary" : "Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket",
  "details" : "### Summary\n\n[`server.fs`](https://vite.dev/config/server-options#server-fs-strict) check was not enforced to the `fetchModule` method that is exposed in Vite dev server's WebSocket. \n\n### Impact\n\nOnly apps that match the following conditions are affected:\n\n- explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host))\n- WebSocket is not disabled by `server.ws: false`\n\nArbitrary files on the server (development machine, CI environment, container, etc.) can be exposed.\n\n### Details\n\nIf it is possible to connect to the Vite dev server’s WebSocket **without an `Origin` header**, an attacker can invoke `fetchModule` via the custom WebSocket event `vite:invoke` and combine `file://...` with `?raw` (or `?inline`) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., `export default \"...\"`).\n\nThe access control enforced in the HTTP request path (such as `server.fs.allow`) is not applied to this WebSocket-based execution path.\n\n### PoC\n\n1. Start the dev server on the target \n   Example (used during validation with this repository):\n   ```bash\n   pnpm -C playground/alias exec vite --host 0.0.0.0 --port 5173\n   ```\n\n2. Confirm that access is blocked via the HTTP path (example: arbitrary file)\n   ```bash\n   curl -i 'http://localhost:5173/@fs/etc/passwd?raw'\n   ```\n   Result: `403 Restricted` (outside the allow list)\n   <img width=\"3898\" height=\"1014\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f6593377-549c-45d7-b562-5c19833438af\" />\n\n3. Confirm that the same file can be retrieved via the WebSocket path\n   By connecting to the HMR WebSocket without an `Origin` header and sending a `vite:invoke` request that calls `fetchModule` with a `file://...` URL and `?raw`, the file contents are returned as a JavaScript module.\n  <img width=\"1049\" height=\"296\" alt=\"image\" src=\"https://github.com/user-attachments/assets/af969f7b-d34e-4af4-8adb-5e2b83b31972\" />\n  <img width=\"1382\" height=\"955\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6a230d2e-197a-4c9c-b373-d0129756d5d7\" />",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "vite"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "8.0.0"
      }, {
        "fixed" : "8.0.5"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 8.0.4"
    }
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "vite"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "7.0.0"
      }, {
        "fixed" : "7.3.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 7.3.1"
    }
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "vite"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "6.0.0"
      }, {
        "fixed" : "6.4.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 6.4.1"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-39363"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/vitejs/vite/pull/22159"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/vitejs/vite/commit/f02d9fde0b195afe3ea2944414186962fbbe41e0"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/vitejs/vite"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/vitejs/vite/releases/tag/v6.4.2"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/vitejs/vite/releases/tag/v7.3.2"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/vitejs/vite/releases/tag/v8.0.5"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200", "CWE-306" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-06T18:03:24Z",
    "nvd_published_at" : "2026-04-07T20:16:30Z"
  }
}