Vitejs and Voidzero Vite: Arbitrary File Read (CVE-2026-39636)

CVE-2026-39636 is a high-severity vulnerability affecting Vitejs Vite and Voidzero Vite that permits unauthorized reading of arbitrary files from the host system. The vulnerability originates from insufficient validation within the WebSocket-based fetchModule component. Attackers can bypass existing HTTP filesystem security controls by sending a file:// URL within a WebSocket payload. A public proof-of-concept exploit script has been published, targeting WebSocket interfaces often exposed on port 8080.

Impact

Successful exploitation allows unauthenticated remote attackers to read arbitrary files from the filesystem of the server running the affected Vite application, potentially leading to the disclosure of sensitive source code, configuration files, or environment variables.

Recommendation

• Upgrade Vitejs Vite installations to versions beyond 8.0.4.
• Upgrade Voidzero Vite installations to versions beyond 0.1.15.
• Audit infrastructure for Vite development or build servers exposing WebSocket interfaces to untrusted networks, particularly on port 8080.
• Implement network-level access controls to restrict access to the Vite development server interface to authorized internal IP ranges only.