CVE-2026-39363
HIGH NUCLEIVite Affected by Arbitrary File Read via Vite Dev Server WebSocket
Title source: cnaExploitation Summary
EIP tracks 3 public exploits for CVE-2026-39363. PoCs published by Hex0rc1st, f4s1on, Firebasky. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-39363, a Vite Dev Server WebSocket arbitrary file read vulnerability. The exploit leverages a security check bypass in the `fetchModule` RPC call to read files outside the project directory when `server.fs.allow` is loosely configured.
Description
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "..."). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
Exploits (3)
This repository contains a functional exploit for CVE-2026-39363, a Vite Dev Server WebSocket arbitrary file read vulnerability. The exploit leverages a security check bypass in the `fetchModule` RPC call to read files outside the project directory when `server.fs.allow` is loosely configured.
Nuclei Templates (1)
title:"Vite App"
body="/@vite/client"
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N