Skip to content
Threat Feed
Subscribe

Product

Vite (<= 6.4.1, 7.3.1, 8.0.4)

1 brief RSS
low advisory

Vitejs and Voidzero Vite: Arbitrary File Read (CVE-2026-39636)

Vitejs and Voidzero Vite contain a vulnerability (CVE-2026-39636) in the WebSocket-based fetchModule call that allows unauthenticated attackers to bypass filesystem checks and read arbitrary files by injecting file:// URLs into WebSocket payloads.

Vite +1 arbitrary-file-read web-vulnerability websocket
1c