GHSA-p9ff-h696-f583 Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

• npm vite: >= 8.0.0, < 8.0.5 → fixed in 8.0.5 • npm vite: >= 7.0.0, < 7.3.2 → fixed in 7.3.2 • npm vite: >= 6.0.0, < 6.4.2 → fixed in 6.4.2

Summary `server.fs` check was not enforced to the `fetchModule` method that is exposed in Vite dev server's WebSocket. Impact Only apps that match the following conditions are affected: • explicitly exposes the Vite dev server to the network (using `--host` or `server.host` config option) • WebSocket is not disabled by `server.ws: false` Arbitrary files on the server (development machine, CI environment, container, etc.) can be exposed. Details If it is possible to connect to the Vite dev server’s WebSocket without an `Origin` header, an attacker can invoke `fetchModule` via the custom WebSocket event `vite:invoke` and combine `file://...` with `?raw` (or `?inline`) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., `export default "..."`). The access control enforced in the HTTP request path (such as `server.fs.allow`) is not applied to this WebSocket-based execution path. PoC 1. Start the dev server on the target Example (used during validation with this repository): ```bash pnpm -C playground/alias exec vite --host 0.0.0.0 --port 5173 ``` 2. Confirm that access is blocked via the HTTP path (example: arbitrary file) ```bash curl -i 'http://localhost:5173/@fs/etc/passwd?raw' ``` Result: `403 Restricted` (outside the allow list) 3. Confirm that the same file can be retrieved via the WebSocket path By connecting to the HMR WebSocket without an `Origin` header and sending a `vite:invoke` request that calls `fetchModule` with a `file://...` URL and `?raw`, the file contents are returned as a JavaScript module.