CVE-2026-39363

CVE-2026-39363 — Vite Dev Server Arbitrary File Read PoC A drop-in PoC for GHSA-p9ff-h696-f583. It reads arbitrary files from the machine running the dev server by calling fetchModule over an unauthenticated HMR WebSocket, bypassing the HTTP-layer server.fs.allow restriction. Affected Versions...