8.2
High
CVE-2026-39363 Vite is a frontend tooling framework for JavaScript
Description
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "..."). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| vite 8.0 | 8.0.0 → < 8.0.5 | 8.0.5 |
| vite 7.0 | 7.0.0 → < 7.3.2 | 7.3.2 |
| vite 6.0 | 6.0.0 → < 6.4.2 | 6.4.2 |
| vite-plus 0.1 | earliest → < 0.1.16 | 0.1.16 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 1779783248 | earliest → < 1779783248 | 1779783248 |
| Red Hat Ansible Automation Platform 2 | Versions not published |
Show the 9 other branches Hide the 9 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Build of Keycloak | Versions not published | |
| Red Hat Build of Podman Desktop | Versions not published | |
| Red Hat Build of Podman Desktop - Tech Preview | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 10 | Versions not published | |
| Red Hat Advanced Cluster Security 4 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat Ansible Automation Platform 2.7 1787218409 | earliest → < 1787218409 | 1787218409 |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of vite
The 28 CVEs of vite →
CVE-2026-118662
Vite is a frontend tooling framework for JavaScript
6.9
Medium
CVE-2026-112947
Vite is a frontend tooling framework for JavaScript
6.3
Medium
CVE-2026-112946
Vite is a frontend tooling framework for JavaScript
6.3
Medium
CVE-2026-112945
Vite is a frontend tooling framework for JavaScript
2.1
Low