Vite development server versions from 2.5.1 up to but not including 6.0.9 have a vulnerability that allows any website to send requests to the dev server and read responses due to permissive default CORS settings and lack of Origin header validation on WebSocket connections. This affects even local-only dev servers. The vulnerability can expose sensitive development files to malicious websites. A fix is available in newer Vite versions. Mitigations include configuring CORS origins, allowed hosts, and using HTTPS or updated browsers. Some mitigations are not possible without upgrading.