Vite allows any websites to send any requests to the development server and read the response

Vite's development server accepts requests from any website without proper security checks, allowing attackers to send commands to your local development environment and read sensitive responses. This happens because CORS protections are not enabled by default.

The vulnerability stems from misconfigured CORS policies and insufficient Origin header validation on WebSocket connections in Vite's development server. An attacker can exploit this via cross-site requests from any origin to perform arbitrary requests against the dev server and exfiltrate responses, affecting developers during the development phase.