The vulnerability allows the first four bytes of any file located outside the configured server.fs directory to be exposed through an HTTP request that includes the query parameter ?vite-wasm-instance. The internal WebAssembly plugin processes the request, strips the query, and reads the referenced file directly from disk without performing the server.fs access check. When the file cannot be parsed as WebAssembly, Vite returns an error that contains the file’s initial four bytes. This leads to an information‑exposure weakness defined by CWE‑200, CWE‑209, and CWE‑22; an attacker can glean potentially sensitive data from arbitrary files on the host.

Vite and Vite‑Plus were affected. The vulnerability exists in all releases prior to the fixed releases 8.2.4 and 8.3.3, and the fix was applied in those releases and in all later versions. No other vendors are listed.

The CVSS score of 6.3 indicates moderate severity. An attacker can exploit the issue by sending a GET request containing ?vite-wasm-instance to a Vite server, learning the first four bytes of arbitrary files. The EPSS metric is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires direct HTTP access to the server, making it most relevant to developers using Vite in non‑production or internal environments.