Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.
CVE-2026-39363 is a low severity vulnerability with a CVSS score of 0.0. No known exploits currently, and patches are available.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
server.fs check was not enforced to the fetchModule method that is exposed in Vite dev server's WebSocket.
Only apps that match the following conditions are affected:
--host or server.host config option)server.ws: falseArbitrary files on the server (development machine, CI environment, container, etc.) can be exposed.
If it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "...").
The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path.
Start the dev server on the target Example (used during validation with this repository):
pnpm -C playground/alias exec vite --host 0.0.0.0 --port 5173
Confirm that access is blocked via the HTTP path (example: arbitrary file)
curl -i 'http://localhost:5173/@fs/etc/passwd?raw'
Result: 403 Restricted (outside the allow list)
<img width="3898" height="1014" alt="image" src="https://github.com/user-attachments/assets/f6593377-549c-45d7-b562-5c19833438af" />
Confirm that the same file can be retrieved via the WebSocket path
By connecting to the HMR WebSocket without an Origin header and sending a request that calls with a URL and , the file contents are returned as a JavaScript module.
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.
vite:invokefetchModulefile://...?raw