CVE-2026-39363
HighPublic exploitVite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
Published Apr 6, 2026 · Updated Sep 10, 2026 · Also known as GHSA-p9ff-h696-f583, ROOT-APP-NPM-CVE-2026-39363
Key Facts
Patch immediately- CVE-2026-39363 is a high-severity vulnerability (CVSS 8.2 v4) affecting Vite (Vitejs), Vite\+ (Voidzero), commercial-gitlab-rails-ee-19.1 (chainguard) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 2.6% probability of exploitation in the next 30 days.
- Fixed versions are available, including @rootio/vite 6.4.1-root.io.1, @rootio/vite 6.4.1-root.io.2, @rootio/vite 6.4.1-root.io.3.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
CVSS v4
8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (30-day exploit likelihood)
2.6%
Higher than 85.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2026-39363 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "..."). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
Affected Products
36 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| ViteVitejs | >= 8.0.0, >= >= 8.0.0, < 8.0.5 | 6.4.1 |
| Vite\+Voidzero | See advisory | 0.1.15 |
| commercial-gitlab-rails-ee-19.1chainguard | See advisory | 19.1.7-r3 |
| commercial-gitlab-rails-ee-19.2chainguard | See advisory | 19.2.7-r1 |
| commercial-gitlab-rails-ee-19.3chainguard | See advisory | 19.3.3-r1 |
Patched Releases
@rootio/vite
6.4.1-root.io.1, 6.4.1-root.io.2, 6.4.1-root.io.3
ansible-automation-platform
27/gateway-rhel9:1787218409
automation-gateway
0:2.5.20260422-3.el8ap, 0:2.5.20260422-3.el9ap
automation-platform-ui
0:2.6.9-1.el9ap
commercial-gitlab-rails-ee-19.1
19.1.7-r3
commercial-gitlab-rails-ee-19.2
19.2.7-r1
commercial-gitlab-rails-ee-19.3
19.3.3-r1
commercial-gitlab-rails-ee-19.4
19.4.1-r1
commercial-gitlab-rails-ee-fips-19.2
19.2.7-r1
commercial-gitlab-rails-ee-fips-19.3
19.3.3-r1
commercial-gitlab-rails-ee-fips-19.4
19.4.1-r1
gitlab-rails-ce-19.1
19.1.2-r2
gitlab-rails-ce-fips-19.1
19.1.1-r3
gitlab-rails-ce-fips-19.2
19.2.1-r1
langfuse-3
3.179.1-r3, 3.187.0-r0, 3.225.7-r6
langfuse-fips-3
3.179.1-r2
openclaw
2026.4.7-r0
verdaccio
6.6.0-r0
Vite
6.4.1-aikido.2, 6.4.1-aikido.3, 6.4.2, 7.3.2, 8.0.11-r0, 8.0.5, 6.4.1
vite-plus
0.1.16
vitess-22
22.0.4-r9
vitess-23
23.0.3-r11
Vite\+
0.1.15
Timeline
Publicly disclosed
Apr 6, 2026
Last updated
Sep 10, 2026
Weakness Type
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-306 Missing Authentication for Critical Function
- CWE-1220 Insufficient Granularity of Access Control
References
- advisoryRHSA-2026:24761
- advisoryRHSA-2026:24762
- advisoryRHSA-2026:24866
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39363.json
FAQ
Common Questions.
Vite is a frontend tooling framework for JavaScript.
Affected: Vite (Vitejs) versions >= 8.0.0, >= >= 8.0.0, < 8.0.5; Vite\+ (Voidzero); commercial-gitlab-rails-ee-19.1 (chainguard), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including @rootio/vite 6.4.1-root.io.1, @rootio/vite 6.4.1-root.io.2, @rootio/vite 6.4.1-root.io.3.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-39363 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo