CVE-2026-39363

OVERVIEW CVE-2026-39363 is a file disclosure vulnerability affecting Vite, a popular frontend build tool and development server for JavaScript projects. The vulnerability exists in versions 6.0.0 through 6.4.1, 7.0.0 through 7.3.1, and 8.0.0 through 8.0.4. Attackers can exploit a WebSocket connection to the Vite dev server to read arbitrary files from the server filesystem by using the fetchModule function combined with file:// protocol handlers and query parameters like ?raw or ?inline, effectively bypassing intended access controls. SEVERITY The vulnerability carries a CVSS v3.1 score of 7.5 (HIGH) with a network-based attack vector, low complexity, requiring no privileges or user interaction. The impact is confidentiality-focused, allowing unauthorized disclosure of sensitive file contents such as environment variables, source code, and configuration files. The attack requires only network connectivity to an exposed Vite dev server without Origin header validation, making exploitation straightforward. The EPSS score of 0.023 indicates this vulnerability has lower probability of exploitation compared to most CVEs. EXPLOITATION STATUS There is no indication of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog and is currently inactive on threat intelligence hot lists. However, organizations running affected Vite versions in development environments exposed to untrusted networks face potential risk. Immediate patching to versions 6.4.2, 7.3.2, or 8.0.5 is recommended, particularly for internet-facing dev servers.