Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

🗓️ 06 Apr 2026 18:03:24Reported by GitHub Advisory DatabaseType

Vite dev server WebSocket fetchModule bypasses file-system checks, enabling arbitrary file reads if exposed.

Reporter	Title	Published	Views	Family All 28
GithubExploit	Exploit for CVE-2026-39363	8 Apr 202615:31	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Vitejs Vite	6 May 202603:42	–	githubexploit
ATTACKERKB	CVE-2026-39363	7 Apr 202619:10	–	attackerkb
Chainguard	CVE-2026-39363 vulnerabilities	10 Apr 202602:14	–	cgr
Circl	CVE-2026-39363	6 Apr 202612:11	–	circl
CNNVD	Vite 访问控制错误漏洞	7 Apr 202600:00	–	cnnvd
CVE	CVE-2026-39363	7 Apr 202619:10	–	cve
Cvelist	CVE-2026-39363 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket	7 Apr 202619:10	–	cvelist
NVD	CVE-2026-39363	7 Apr 202620:16	–	nvd
OSV	CGA-MR48-WPPJ-4QV8	9 Apr 202614:46	–	osv

Vulners

Node

vitejs viteRange6.0.0–6.4.1npm

vitejs viteRange7.0.0–7.3.1npm

vitejs viteRange8.0.0–8.0.4npm

Source	Link
github	www.github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583
github	www.github.com/vitejs/vite/pull/22159
github	www.github.com/vitejs/vite/commit/f02d9fde0b195afe3ea2944414186962fbbe41e0
github	www.github.com/vitejs/vite/releases/tag/v6.4.2
github	www.github.com/vitejs/vite/releases/tag/v7.3.2
github	www.github.com/vitejs/vite/releases/tag/v8.0.5
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-39363
github	www.github.com/advisories/GHSA-p9ff-h696-f583

07 Apr 2026 22:16Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.17.5

CVSS 48.2

EPSS0.08748