IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
8.2Alta

CVE-2026-39363Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

vitejs vite; vitejs vite-plus; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Publicada: (hace 7 meses)

Descripción

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "..."). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.

Debilidad (CWE): CWE-200CWE-306CWE-1220

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
ansible automation platform 2.5 —
ansible automation platform 2.6 —
ansible automation platform 2.7 —
Red Hat Red Hat Advanced Cluster Security 4 —
Red Hat Red Hat Ansible Automation Platform 2 all versions
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 all versions
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 all versions
Red Hat Red Hat Ansible Automation Platform 2.6 all versions
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 all versions
Red Hat Red Hat Ansible Automation Platform 2.7 all versions
Red Hat Red Hat Build of Keycloak all versions
Red Hat Red Hat Build of Podman Desktop all versions
Red Hat Red Hat Build of Podman Desktop - Tech Preview all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8 —
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack —
Red Hat Red Hat OpenShift Container Platform 4 all versions
vitejs vite >= 8.0.0, < 8.0.5, >= 7.0.0, < 7.3.2, >= 6.0.0, < 6.4.2
vitejs vite-plus < 0.1.16
voidzero vite+ ≤ 0.1.15

Referencias y parches

Coincidencias CPE (NVD) (4)
  • cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* ≥ 6.0.0 ≤ 6.4.1
  • cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* ≥ 7.0.0 ≤ 7.3.1
  • cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* ≥ 8.0.0 ≤ 8.0.4
  • cpe:2.3:a:voidzero:vite\+:*:*:*:*:*:node.js:*:* ≤ 0.1.15