Security Intelligence
Loading table of contents...
At a glance:
-
Researchers observed internet-wide scanning activity targeting internet-exposed Vite development servers and attempting to retrieve credentials, environment files, and infrastructure data.
-
The vulnerability requires specific deployment and configuration conditions and primarily affects Vite instances that have been made accessible beyond the local host.
-
Upgrading affected versions, reviewing external exposure, and evaluating potentially exposed credentials helps reduce the risk from observed scanning activity.
Threat summary
On September 11, 2026, researchers reported sustained internet-wide scanning activity targeting exposed Vite instances through exploitation of a file disclosure vulnerability. Researchers recorded 807 attack sessions and approximately 32,000 related events during August 2026.
Vite is a frontend development and build tool used to create and test JavaScript web applications. During development, it runs a local web service that allows developers to view and interact with applications in a browser. The flaw, tracked as CVE-2026-39364, affects that functionality.
Vite includes controls intended to block browser access to sensitive files stored on the host system, such as environment files, certificates, and application configuration data. The vulnerability allows those protections to be bypassed, enabling files that would normally be inaccessible through the browser to be retrieved through a specially crafted web request.
The Vite security advisory includes a proof-of-concept (POC) demonstrating that a file normally returned with an HTTP 403 Forbidden response can instead be retrieved with an HTTP 200 response when specific query parameters are appended to the request.
Exploitation depends on how Vite is deployed and configured:
-
The service must be reachable over a network
-
The targeted file must reside in a directory that Vite is permitted to access
-
The file must match a pattern protected by the server.fs.deny control
Researchers observed scanning activity targeting files commonly associated with cloud and application credentials, including .env files, Amazon Web Services (AWS) credential files, Microsoft Azure tokens, Terraform state files, and Linux environment files. The requests also included path traversal variants and double-encoded paths. The activity focused on identifying exposed Vite servers and retrieving sensitive files commonly associated with cloud services and application deployments.
Earlier Vite vulnerabilities, including CVE-2025-30208 and CVE-2025-31125, were also targeted by the same scanning infrastructure observed by researchers. In each case, the objective was gaining access to sensitive files and application data rather than disrupting the service itself.
Affected versions include Vite:
-
7.1.0 through 7.3.1
-
8.0.0 through 8.0.4
The vulnerability was disclosed on April 7, 2026, carries a CVSS v4 score of 8.2, and was fixed in Vite 7.3.2 and 8.0.5.
Analysis
Unlike production web applications, development environments often contain credentials, configuration data, and infrastructure information that support multiple systems simultaneously. A single development host may have access to cloud platforms, source code repositories, continuous integration pipelines, testing environments, and deployment tooling.
As a result, the value of a successful attack depends less on the affected Vite instance itself and more on the files stored alongside it.
The scanning activity observed by researchers suggests that threat actors are treating exposed Vite instances as an opportunity to collect credentials rather than as a target for direct compromise. The requests focused on files commonly associated with cloud access, application configuration, and infrastructure management.
In these environments, credential theft can provide a more efficient path to additional systems than attempting to compromise the application server itself.
Organizations that make development environments accessible outside the local host face the greatest exposure. While Vite binds to localhost by default, development workflows frequently introduce network accessibility through collaboration requirements, containerized deployments, cloud-hosted development environments, and testing infrastructure. The observed activity indicates that threat actors are actively searching for exposed instances rather than waiting for individual targets to be identified.
The confirmed impact of CVE-2026-39364 is unauthorized access to protected files. The potential impact depends entirely on the contents of those files. In environments where cloud credentials, service accounts, signing certificates, or infrastructure-as-code state files are accessible, disclosure of those assets could provide access to cloud resources, development platforms, source code repositories, or other connected services. Those outcomes require valid credentials to be present and are not directly provided by the vulnerability itself.
The activity also reflects a broader trend of threat actors targeting exposed developer tooling, indicating interest in development systems as a source of credentials and operational data rather than disruption of the development service itself.
Mitigations
Identifying Vite deployments across development, testing, staging, and cloud environments helps determine whether affected versions are present. Upgrading systems running Vite 7.1.0 through 7.3.1 or 8.0.0 through 8.0.4 to Vite 7.3.2, 8.0.5, or later releases removes the vulnerable file-access behavior associated with CVE-2026-39364.
Reviewing how Vite is exposed within the environment helps determine whether exploitation requirements are present. Deployments that only listen on localhost do not meet the remote exploitation conditions described in the advisory, while systems exposed through --host, server.host, container port mappings, ingress rules, load balancers, or firewall exceptions warrant additional review because they are reachable over a network.
Examining environment files, cloud credentials, certificates, and infrastructure configuration data stored on exposed systems helps identify information that may have been accessible during scanning activity. Credential rotation and access reviews reduce the risk of unauthorized access if sensitive data was disclosed.
Monitoring web server, reverse proxy, and application logs for requests targeting the /@fs/ endpoint, protected files, ?raw and ?import&raw query parameters, and encoded path traversal patterns can help identify exploitation attempts. These request patterns were observed during activity targeting CVE-2026-39364.
Limiting development tools to trusted networks and avoiding unnecessary internet exposure reduces the number of systems accessible to automated scanning and credential-harvesting activity.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
