CVE-2026-39363High· 7.5▾ MidnightPoC availableVite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custo…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.7 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
3.3%
3.3% → 3.4%
3 GitHub repos · Nuclei ×1
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "..."). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
vite >= 6.0.0, <= 6.4.1vite >= 7.0.0, <= 7.3.1vite >= 8.0.0, <= 8.0.4vite+ <= 0.1.15Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-39364High· 7.5Vite is a frontend tooling framework for JavaScript
CVE-2026-53571Mediumvite: `server.fs.deny` bypass on Windows alternate paths
CVE-2026-112947Medium· 6.3Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
CVE-2025-58752Medium· 5.3Vite is a frontend tooling framework for JavaScript
CVE-2026-16108Medium· 4.3A flaw was found in the default-groups REST endpoint and realm representation of Keycloak
CVE-2026-112946Medium· 6.3Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine