{"cves":{"cve":{"cveNumber":"CVE-2026-39363","cveUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-39363"}},"description":"Vite是一款新一代前端构建工具。Vite-plus是一个统一的前端开发工具链。\n\nVite存在任意文件读取漏洞，该漏洞源于开发服务器的WebSocket连接未能正确验证Origin头，攻击者可利用该漏洞通过vite:invoke事件调用fetchModule函数，结合file://协议和特定查询参数，以JavaScript字符串形式读取服务器上的任意文件。","formalWay":"目前厂商已发布升级程序修复该安全问题，详情见厂商官网:\r\nhttps://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583","isEvent":"通用软硬件漏洞","number":"CNVD-2026-43182","openTime":"2026-10-30","patchDescription":"Vite是一款新一代前端构建工具。Vite-plus是一个统一的前端开发工具链。\r\n\r\nVite存在任意文件读取漏洞，该漏洞源于开发服务器的WebSocket连接未能正确验证Origin头，攻击者可利用该漏洞通过vite:invoke事件调用fetchModule函数，结合file://协议和特定查询参数，以JavaScript字符串形式读取服务器上的任意文件。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。","patchName":"Vite和Vite-plus任意文件读取漏洞的补丁","products":{"product":["Vite Vite >=8.0.0, <8.0.5","Vite Vite >=7.0.0, <7.3.2","Vite Vite >=6.0.0, <6.4.2","Vite vite-plus <0.1.16"]},"referenceLink":"https://nvd.nist.gov/vuln/detail/cve-2026-39363","serverity":"高","submitTime":"2026-04-08","title":"Vite和Vite-plus任意文件读取漏洞"}