CVE-2026-39363 - Vite Dev Server - Arbitrary File Read

[theamanrawat]

PR Information

• Fixed CVE-2020-XXX / Added CVE-2020-XXX / Updated CVE-2020-XXX
• References:

Template validation

• Validated with a host running a vulnerable version and/or configuration (True Positive)
• Validated with a host running a patched version and/or configuration (avoid False Positive)

Additional Details (leave it blank if not applicable)

Additional References:

• Nuclei Template Creation Guideline
• Nuclei Template Matcher Guideline
• Nuclei Template Contribution Guideline
• PD-Community Discord server

[neo-by-projectdiscovery-dev]

Neo - Nuclei Template Review

High: 1

Current PR state: 1 high active finding.

Highlights

• High: Host Header Injection in WebSocket Upgrade Request in javascript/cves/2026/CVE-2026-39363.yaml:33

High (1)

• Host Header Injection in WebSocket Upgrade Request — javascript/cves/2026/CVE-2026-39363.yaml:33
  The WebSocket upgrade request on line 33 hardcodes localhost in the Host header instead of using the dynamic target_host variable. When scanning remote Vite dev servers (e.g., example.com:5173), the template sends Host: localhost:5173 instead of Host: example.com:5173, which will cause the connection to fail or be rejected by the server.

_{Comment @pdneo help for available commands. · Open in Neo}