{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-39363",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-39363",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-04-07T19:10:44.916Z",
    "updatedAt": "2026-08-25T12:05:41.283Z",
    "importedAt": "2026-10-24T01:58:08.712Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket",
      "summary": "Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default \"...\"). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.",
      "affected": [
        {
          "vendor": "vitejs",
          "product": "vite",
          "versions": [
            {
              "version": ">= 8.0.0, < 8.0.5",
              "status": "affected"
            },
            {
              "version": ">= 7.0.0, < 7.3.2",
              "status": "affected"
            },
            {
              "version": ">= 6.0.0, < 6.4.2",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "vitejs",
          "product": "vite-plus",
          "versions": [
            {
              "version": "< 0.1.16",
              "status": "affected"
            }
          ]
        }
      ]
    }
  }
}