CVE-2026-39363: Vite blocks a file over HTTP but serves it via the HMR WebSocket

CVE-2026-39363 was discovered in Vite — a popular build tool and development server for modern web development. The vulnerability allows remote attackers to read arbitrary files accessible to the server process. It was introduced in Vite 6.0.0 and can be exploited when the development server is exposed to the network, for example, when launched with vite --host.

For a regular HTTP request, Vite restricts access to files outside the allowed directories: /@fs/etc/passwd?raw → 403 Restricted However, the same file could be retrieved through the HMR WebSocket, where the corresponding check was missing. The HMR WebSocket is protected by a token, but Vite checked it only for connections with an Origin header. A non-browser client could connect without an Origin header and without a token — the developers assumed that such a client already had access to the HTTP interface and that the WebSocket did not provide any additional capabilities. With the introduction of the Environment API in Vite 6.0, this assumption was no longer valid. The HMR WebSocket gained the vite:invoke RPC mechanism and the fetchModule method, allowing clients to request module source code. Through fetchModule, an attacker could request an arbitrary local file: file:///etc/passwd?raw The fetchModule method called transformRequest without enforcing the server.fs.allow check that protected the HTTP route. The ?raw path then read the file from disk and returned its contents via the WebSocket.

With network access to the development server, an attacker could potentially read .env files, SSH keys, AWS credentials, npm/GitHub tokens, and other local data accessible to the server process. Prior knowledge of the HMR token was not required.

The vulnerability was fixed in Vite 6.4.2, 7.3.2, and 8.0.5. File access checks were moved directly into transformRequest, and fetchModule was disabled for the client-side HMR WebSocket.

Article: https://nefariousplan.com/posts/vite-fs-route-returns-403-hmr-socket-returns-the-file

PoC: https://github.com/f4s1on/CVE-2026-39363