Vite (<= 6.4.1, 7.3.1, 8.0.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/vite--6.4.1-7.3.1-8.0.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 21:31:08 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgVitejs and Voidzero Vite: Arbitrary File Read (CVE-2026-39636)https://feed.craftedsignal.io/briefs/2026-10-vite-arbitrary-file-read/Sat, 24 Oct 2026 21:31:08 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-vite-arbitrary-file-read/Vitejs and Voidzero Vite contain a vulnerability (CVE-2026-39636) in the WebSocket-based fetchModule call that allows unauthenticated attackers to bypass filesystem checks and read arbitrary files by injecting file:// URLs into WebSocket payloads.CVE-2026-39636 is a high-severity vulnerability affecting Vitejs Vite and Voidzero Vite that permits unauthorized reading of arbitrary files from the host system. The vulnerability originates from insufficient validation within the WebSocket-based fetchModule component. Attackers can bypass existing HTTP filesystem security controls by sending a file:// URL within a WebSocket payload. A public proof-of-concept exploit script has been published, targeting WebSocket interfaces often exposed on port 8080.

Impact

Successful exploitation allows unauthenticated remote attackers to read arbitrary files from the filesystem of the server running the affected Vite application, potentially leading to the disclosure of sensitive source code, configuration files, or environment variables.

Recommendation

  • Upgrade Vitejs Vite installations to versions beyond 8.0.4.
  • Upgrade Voidzero Vite installations to versions beyond 0.1.15.
  • Audit infrastructure for Vite development or build servers exposing WebSocket interfaces to untrusted networks, particularly on port 8080.
  • Implement network-level access controls to restrict access to the Vite development server interface to authorized internal IP ranges only.
]]>lowadvisoryarbitrary-file-readweb-vulnerabilitywebsocketvite