CVE-2026-39363

server.fs check was not enforced to the fetchModule method that is exposed in Vite dev server's WebSocket.

Details

If it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "...").

The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path.

PoC

1. Start the dev server on the target
   Example (used during validation with this repository):

   pnpm -C playground/alias exec vite --host 0.0.0.0 --port 5173
   

2. Confirm that access is blocked via the HTTP path (example: arbitrary file)

   curl -i 'http://localhost:5173/@fs/etc/passwd?raw'
   

   Result: 403 Restricted (outside the allow list)

3. Confirm that the same file can be retrieved via the WebSocket path
   By connecting to the HMR WebSocket without an Origin header and sending a vite:invoke request that calls fetchModule with a file://... URL and ?raw, the file contents are returned as a JavaScript module.

Only apps that match the following conditions are affected:

• explicitly exposes the Vite dev server to the network (using --host or server.host config option)
• WebSocket is not disabled by server.ws: false

Arbitrary files on the server (development machine, CI environment, container, etc.) can be exposed.

A critical operation is accessible without requiring any authentication. Typical impact: any user can invoke the privileged function.

Kodem intelligence

1. What is CVE-2026-39363? CVE-2026-39363 is a high-severity missing authentication for critical function vulnerability in vite (npm), affecting versions >= 8.0.0, <= 8.0.4. It is fixed in 8.0.5, 7.3.2, 6.4.2. A critical operation is accessible without requiring any authentication.
2. Which versions of vite are affected by CVE-2026-39363? vite (npm) versions >= 8.0.0, <= 8.0.4 is affected.
3. Is there a fix for CVE-2026-39363? Yes. CVE-2026-39363 is fixed in 8.0.5, 7.3.2, 6.4.2. Upgrade to this version or later.
4. Is CVE-2026-39363 exploitable, and should I be worried? Whether CVE-2026-39363 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-39363 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-39363?
   • Upgrade vite to 8.0.5 or later
   • Upgrade vite to 7.3.2 or later
   • Upgrade vite to 6.4.2 or later