An attacker who can connect to the Vite dev server’s WebSocket without an Origin header can trigger the vite:invoke event to call fetchModule. By combining a file:// path with the ?raw or ?inline query, the attacker can read the contents of any file on the server as a JavaScript string. This allows disclosure of sensitive file data, such as configuration files or secrets, violating confidentiality. The vulnerability demonstrates weaknesses corresponding to CWE-1220, CWE-200, and CWE-306.

Vite, including the vite-plus variant, is affected in all releases from 6.0.0 up to, but not including, 6.4.2, as well as the isolated releases 7.3.2 and 8.0.5. Users of these versions that run a Vite dev server exposed to network traffic are vulnerable. The fix is available in 6.4.2, 7.3.2, and 8.0.5 and later.

The CVSS score of 8.2 indicates a high severity vulnerability. Exploitation requires network access to the dev server’s WebSocket and no authentication. Because the exploit path does not require special privileges or origin validation, any remote actor who can reach the WebSocket can read arbitrary files. The EPSS score is 2%, indicating a moderate likelihood of exploitation, and the vulnerability is not listed in CISA's KEV catalog, but the high CVSS reflects the potential impact and ease of exploitation.