WebSocket Vulnerability in Vite Frontend Framework
CVE-2026-39363

8.2HIGH

Key Information:

Vendor

Vitejs

Status
Vite
Vite-plus
Vendor
CVE Published:
7 April 2026

What is CVE-2026-39363?

A vulnerability in the Vite frontend tooling framework allows unauthorized access to arbitrary files on the server. If an attacker connects to the Vite development server's WebSocket without an Origin header, they can exploit the custom WebSocket event 'vite:invoke' to retrieve file contents as JavaScript strings. This bypasses standard access control mechanisms, leading to potential information disclosure. The issue is addressed in versions 6.4.2, 7.3.2, and 8.0.5.

Affected Version(s)

vite >= 8.0.0, < 8.0.5 < 8.0.0, 8.0.5

vite >= 7.0.0, < 7.3.2 < 7.0.0, 7.3.2

vite >= 6.0.0, < 6.4.2 < 6.0.0, 6.4.2

References

https://github.com/vitejs/vite/security/advisories/GHSA-p...
x_refsource_CONFIRM

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.