8.2 High

CVE-2026-39363 Vite is a frontend tooling framework for JavaScript

Description

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "..."). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.

Affected products and versions

Product	Affected versions	Fixed in
vite 8.0	8.0.0 → < 8.0.5	8.0.5
vite 7.0	7.0.0 → < 7.3.2	7.3.2
vite 6.0	6.0.0 → < 6.4.2	6.4.2
vite-plus 0.1	earliest → < 0.1.16	0.1.16
Red Hat Ansible Automation Platform 2.5 for RHEL 8	Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 9	Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 9	Versions not published
Red Hat Ansible Automation Platform 2.6 1779783248	earliest → < 1779783248	1779783248
Red Hat Ansible Automation Platform 2	Versions not published

Show the 9 other branches

Product	Affected versions	Fixed in
Red Hat Build of Keycloak	Versions not published
Red Hat Build of Podman Desktop	Versions not published
Red Hat Build of Podman Desktop - Tech Preview	Versions not published
Red Hat OpenShift Container Platform 4	Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 10	Versions not published
Red Hat Advanced Cluster Security 4	Versions not published
Red Hat JBoss Enterprise Application Platform 8	Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack	Versions not published
Red Hat Ansible Automation Platform 2.7 1787218409	earliest → < 1787218409	1787218409