Skip to content
Threat Feed
Subscribe

Tag

Vite

3 briefs RSS
low advisory

Vitejs and Voidzero Vite: Arbitrary File Read (CVE-2026-39636)

Vitejs and Voidzero Vite contain a vulnerability (CVE-2026-39636) in the WebSocket-based fetchModule call that allows unauthenticated attackers to bypass filesystem checks and read arbitrary files by injecting file:// URLs into WebSocket payloads.

Vite +1 arbitrary-file-read web-vulnerability websocket
1c
medium advisory

@vitejs/plugin-rsc Denial-of-Service Vulnerability in React Server Components

@vitejs/plugin-rsc is vulnerable to a denial-of-service attack due to an embedded vulnerable version of react-server-dom-webpack, potentially causing resource exhaustion.

@vitejs/plugin-rsc +1 denial-of-service react vite
2r 1t 1c
high advisory

Vite Arbitrary File Read Vulnerability via WebSocket

Vite versions 6.0.0 to 8.0.4 are vulnerable to arbitrary file read, allowing attackers to bypass access controls and retrieve the contents of arbitrary files on the server via the WebSocket path when the dev server is exposed to the network.

Vite file-read vulnerability websocket
2r 1t