| Package | Affected versions | Patched versions |
|---|---|---|
| vite | ≥ 6.0.0, ≤ 6.4.1≥ 7.0.0, ≤ 7.3.1≥ 8.0.0, ≤ 8.0.4 | |
| vite+ | ≤ 0.1.15 | |
| vite | ≥ 6.0.0, < 6.4.2≥ 7.0.0, < 7.3.2≥ 8.0.0, < 8.0.5 | 6.4.27.3.28.0.5 |
server.fs check was not enforced to the fetchModule method that is exposed in Vite dev server's WebSocket.
Only apps that match the following conditions are affected:
--host or server.host config option)server.ws: falseArbitrary files on the server (development machine, CI environment, container, etc.) can be exposed.
If it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "...").
The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path.
Start the dev server on the target Example (used during validation with this repository):
pnpm -C playground/alias exec vite --host 0.0.0.0 --port 5173
Confirm that access is blocked via the HTTP path (example: arbitrary file)
curl -i 'http://localhost:5173/@fs/etc/passwd?raw'
Result: 403 Restricted (outside the allow list)
<img width="3898" height="1014" alt="image" src="https://github.com/user-attachments/assets/f6593377-549c-45d7-b562-5c19833438af" />
Confirm that the same file can be retrieved via the WebSocket path
By connecting to the HMR WebSocket without an Origin header and sending a vite:invoke request that calls fetchModule with a file://... URL and ?raw, the file contents are returned as a JavaScript module.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free