WebSocket Vulnerability in Vite Frontend Framework
CVE-2026-39363
Key Information:
Badges
What is CVE-2026-39363?
A vulnerability in the Vite frontend tooling framework allows unauthorized access to arbitrary files on the server. If an attacker connects to the Vite development server's WebSocket without an Origin header, they can exploit the custom WebSocket event 'vite:invoke' to retrieve file contents as JavaScript strings. This bypasses standard access control mechanisms, leading to potential information disclosure. The issue is addressed in versions 6.4.2, 7.3.2, and 8.0.5.
Affected Version(s)
vite >= 8.0.0, < 8.0.5 < 8.0.0, 8.0.5
vite >= 7.0.0, < 7.3.2 < 7.0.0, 7.3.2
vite >= 6.0.0, < 6.4.2 < 6.0.0, 6.4.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.