url.txt → http://host:port
  ↓ Parse host + port
  ↓
┌─ Step 1: Try ws://host:given port
│  ├─ WebSocket handshake success + exploit success → vulnerable
│  └─ Failed → if given port == 5173 → not vulnerable
│
└─ Step 3: Probe host:5173 (only when given port ≠ 5173)
   ├─ Port closed → not vulnerable
   └─ Port open → WebSocket handshake + exploit on 5173
        ├─ Success → vulnerable
        └─ Failed → not vulnerable

pip install -r requirements.txt

# To enable the proxy, uncomment the following two lines and set the correct proxy address and port
# os.environ["HTTP_PROXY"] = "http://127.0.0.1:8083"
# os.environ["HTTPS_PROXY"] = "http://127.0.0.1:8083"

http://192.168.1.100:5173
http://example.com
http://target.cn:8080

python cve_2026_39363.py

[*] Loaded 3 URL(s), scanning with 3 thread(s)...

http://192.168.1.100:5173 vulnerable (Linux)
http://example.com vulnerable (Linux)
http://target.cn:8080 not vulnerable

[*] Done. 2/3 vulnerable, elapsed 3.2s
[*] Results saved to result.txt

http://192.168.1.100:5173 (Linux)
http://example.com:5173 (Linux)

# Start
docker run -d --name vite-vuln -p 5173:5173 vulhub/vite:7.3.1

# Scan
echo "http://127.0.0.1:5173" > url.txt
python cve_2026_39363.py

# Cleanup
docker stop vite-vuln && docker rm vite-vuln