{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/vite--6.4.1-7.3.1-8.0.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":6.5,"id":"CVE-2026-39636"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Vite (\u003c= 6.4.1, 7.3.1, 8.0.4)","Vite (\u003c= 0.1.15)"],"_cs_severities":["low"],"_cs_tags":["arbitrary-file-read","web-vulnerability","websocket","vite"],"_cs_type":"advisory","_cs_vendors":["Vitejs","Voidzero"],"content_html":"\u003cp\u003eCVE-2026-39636 is a high-severity vulnerability affecting Vitejs Vite and Voidzero Vite that permits unauthorized reading of arbitrary files from the host system. The vulnerability originates from insufficient validation within the WebSocket-based fetchModule component. Attackers can bypass existing HTTP filesystem security controls by sending a file:// URL within a WebSocket payload. A public proof-of-concept exploit script has been published, targeting WebSocket interfaces often exposed on port 8080.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to read arbitrary files from the filesystem of the server running the affected Vite application, potentially leading to the disclosure of sensitive source code, configuration files, or environment variables.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Vitejs Vite installations to versions beyond 8.0.4.\u003c/li\u003e\n\u003cli\u003eUpgrade Voidzero Vite installations to versions beyond 0.1.15.\u003c/li\u003e\n\u003cli\u003eAudit infrastructure for Vite development or build servers exposing WebSocket interfaces to untrusted networks, particularly on port 8080.\u003c/li\u003e\n\u003cli\u003eImplement network-level access controls to restrict access to the Vite development server interface to authorized internal IP ranges only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T21:31:08Z","date_published":"2026-10-24T21:31:08Z","id":"https://feed.craftedsignal.io/briefs/2026-10-vite-arbitrary-file-read/","summary":"Vitejs and Voidzero Vite contain a vulnerability (CVE-2026-39636) in the WebSocket-based fetchModule call that allows unauthenticated attackers to bypass filesystem checks and read arbitrary files by injecting file:// URLs into WebSocket payloads.","title":"Vitejs and Voidzero Vite: Arbitrary File Read (CVE-2026-39636)","url":"https://feed.craftedsignal.io/briefs/2026-10-vite-arbitrary-file-read/"}],"language":"en","title":"CraftedSignal Threat Feed - Vite (\u003c= 6.4.1, 7.3.1, 8.0.4)","version":"https://jsonfeed.org/version/1.1"}