CVE-2026-39363 is an information disclosure vulnerability in Vite's development server WebSocket handling. If an attacker connects without an Origin header, they can invoke the fetchModule function via a custom WebSocket event 'vite:invoke' and combine 'file://...' with query parameters like '?raw' or '?inline' to retrieve arbitrary file contents as JavaScript strings. This bypasses the access control enforced on HTTP request paths, such as server.fs.allow. The flaw affects Vite versions >=6.0.0 <6.4.2, >=7.0.0 <7.3.2, and =8.0.0. Fixes are available in versions 6.4.2, 7.3.2, and 8.0.5. The vulnerability has a CVSS 3.1 base score of 8.2 (high severity) with network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact.

An attacker can remotely connect to the Vite development server WebSocket without an Origin header and retrieve arbitrary files from the server, leading to unauthorized disclosure of sensitive information. This bypasses normal access control restrictions that apply to HTTP requests, potentially exposing source code or other sensitive data stored on the server. There is no impact on integrity or availability reported.

Fixes for this vulnerability are available in Vite versions 6.4.2, 7.3.2, and 8.0.5. Users should upgrade to these or later versions to remediate the issue. The Red Hat advisory notes that no alternative mitigations meet their criteria for ease of use and applicability, so upgrading is the recommended action. There is no indication that the vulnerability is mitigated by configuration changes or other workarounds.