An attacker who can connect to the Vite dev server’s WebSocket without an Origin header can trigger a custom vite:invoke event that calls fetchModule. By providing a file:// path appended with ?raw or ?inline, the attacker can obtain the contents of any file on the server encoded as a JavaScript string. This enables the disclosure of sensitive configuration files, secrets, or other confidential data, representing a clear breach of confidentiality and demonstrating weaknesses associated with CWE‑1220, CWE‑200, and CWE‑306.

The Vite framework, including the vite-plus variant, is affected in all releases older than 6.4.2, 7.3.2, and 8.0.5. This includes version ranges such as 6.0.0‑6.4.1, 7.0.0‑7.3.1, and 8.0.0‑8.0.4. Users running a Vite dev server that is exposed to network traffic are at risk until they upgrade to the patched releases.

The CVSS score of 8.2 indicates high severity. Exploitation requires only the ability to reach the dev server’s WebSocket and does not require authentication or elevated privileges, as the server’s HTTP access controls are not applied to the WebSocket path. The EPSS score of 9% shows a moderate likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, but the high CVSS and the ease of remote exploitation make it a significant risk.