NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦 npm
Not in CISA KEV

CVE-2026-39363 — vite

Fix: vitejs/vite#22159

CVE-2026-39363 is a Information Exposure vulnerability in vite. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for vite — see the affected versions and patch details below.

Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

Also known asGHSA-p9ff-h696-f583
Published
Updated
Affected
3 pkgs
Patched
3 / 3
Exploits
1 known
Exploitation data as of Nov 6, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-39363.

EPSS Exploitation Probability

via FIRST.org ↗
3.4%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs89th percentile — riskier than 89% of all scored CVEsHighest risk
0.40%3.82%7.25%10.7%2.3%3.4%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

3 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

7Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream
vitenpm
257.8Mdownloads / week

Description

Summary

server.fs check was not enforced to the fetchModule method that is exposed in Vite dev server's WebSocket.

Impact

Only apps that match the following conditions are affected:

  • explicitly exposes the Vite dev server to the network (using --host or server.host config option)
  • WebSocket is not disabled by server.ws: false

Arbitrary files on the server (development machine, CI environment, container, etc.) can be exposed.

Details

If it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "...").

The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path.

PoC

  1. Start the dev server on the target Example (used during validation with this repository):

    pnpm -C playground/alias exec vite --host 0.0.0.0 --port 5173

  2. Confirm that access is blocked via the HTTP path (example: arbitrary file)

    curl -i 'http://localhost:5173/@fs/etc/passwd?raw'

    Result: 403 Restricted (outside the allow list) <img width="3898" height="1014" alt="image" src="https://github.com/user-attachments/assets/f6593377-549c-45d7-b562-5c19833438af" />

  3. Confirm that the same file can be retrieved via the WebSocket path By connecting to the HMR WebSocket without an Origin header and sending a vite:invoke request that calls fetchModule with a file://... URL and ?raw, the file contents are returned as a JavaScript module.

    <img width="1049" height="296" alt="image" src="https://github.com/user-attachments/assets/af969f7b-d34e-4af4-8adb-5e2b83b31972" />
<img width="1382" height="955" alt="image" src="https://github.com/user-attachments/assets/6a230d2e-197a-4c9c-b373-d0129756d5d7" />

Affected Packages

3 total 3 fixed
EcosystemPackageVulnerable rangeFix
📦npmvite≥ 8.0.0&&< 8.0.58.0.5npm install vite@8.0.5
📦npmvite≥ 7.0.0&&< 7.3.27.3.2npm install vite@7.3.2
📦npmvite≥ 6.0.0&&< 6.4.26.4.2npm install vite@6.4.2

Affected Products

2 products · 4 configurations
Application
vitevitejs
≥ 8.0.0 && ≤ 8.0.4
range
Application
vite\+voidzero
≤ 0.1.15
range
Exploits & PoCs
1

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

Firebasky/CVE-2026-39363

CVE-2026-39363 AI analysis

⭐ 7🍴 0Jul 2026

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for vite, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update vite to 8.0.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-39363 is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant
Workaround published by Red Hat
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Source: Red Hat security advisory for CVE-2026-39363 (CC BY 4.0)
ProductFixed inAdvisory
Red Hat Ansible Automation Platform 2.5 for RHEL 8automation-gateway-0:2.5.20260422-3.el8apRHSA-2026:24761
Red Hat Ansible Automation Platform 2.6 for RHEL 9automation-platform-ui-0:2.6.9-1.el9apRHSA-2026:24762
Red Hat Ansible Automation Platform 2.6ansible-automation-platform-tech-preview/mcp-server-rhel9:1779783248RHSA-2026:24866
Red Hat Ansible Automation Platform 2.7ansible-automation-platform-27/gateway-rhel9:1787218409RHSA-2026:59153

Frequently Asked Questions

### Summary [`server.fs`](https://vite.dev/config/server-options#server-fs-strict) check was not enforced to the `fetchModule` method that is exposed in Vite dev server's WebSocket. ### Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) - WebSocket is not disabled by `server.ws: false` Arbitrary files on the server (development machine, CI environment, container, etc.) can be exposed. ### Details If it is po
O3 Security · Impact-Aware SCA

Is CVE-2026-39363 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-39363: vite — Fixed in 8.0.5