CVE-2026-39363 affects the Vite frontend tooling framework. The flaw allows an attacker who can connect to the Vite dev server's WebSocket without an Origin header to invoke the fetchModule function via the vite:invoke WebSocket event. By combining file:// URLs with ?raw or ?inline query parameters, the attacker can read arbitrary files on the server as JavaScript strings. This bypasses access controls normally enforced on HTTP requests, such as server.fs.allow. The vulnerability affects Vite versions >=6.0.0 <6.4.2, >=7.0.0 <7.3.2, and =8.0.0. Fixes are available in versions 6.4.2, 7.3.2, and 8.0.5. Red Hat advisories confirm the issue and provide patches for affected products.

An attacker without privileges can disclose sensitive information by reading arbitrary files on the server hosting the Vite development server. This exposure occurs because the WebSocket-based fetchModule execution path does not enforce the access control restrictions applied to HTTP requests. The vulnerability has a CVSS 4.0 base score of 8.2 (high severity), indicating a significant risk of sensitive data exposure without requiring user interaction or privileges.

Fixes for this vulnerability are available in Vite versions 6.4.2, 7.3.2, and 8.0.5. Users should upgrade to these or later versions to remediate the issue. The Red Hat advisories linked provide patches for affected Red Hat products incorporating Vite. No vendor advisory states that no action is required or that the issue is already mitigated; therefore, upgrading is the recommended mitigation.