Unauthenticated Arbitrary File Read in Vite Dev Server via @fs Allow-List Bypass
CVSS 3.1
7.5high
EPSS
75%p99
Published
()
Modified
AI analysis
Vite dev servers in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fail to enforce the `@fs` file-access allow list because trailing separators such as `?` are stripped in several places but are not accounted for in the query-string regexes. A remote, unauthenticated attacker triggers the flaw by appending `?raw??` or `?import&raw??` to a dev-server URL, bypassing the restriction and returning the contents of arbitrary files on the host if they exist. The impact is confidentiality only — arbitrary file read with no code execution or privilege escalation, consistent with the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Only projects that explicitly expose the Vite dev server to the network (via `--host` or the `server.host` config option) are affected; purely local development usage is not remotely exploitable. A public proof of concept is available in the GitHub advisory (GHSA-x574-m823-4x7w); the flaw is not yet in CISA KEV, but EPSS assigns a 75% probability of exploitation within 30 days (99th percentile), so opportunistic scanning is likely.
What to do: Upgrade Vite to 6.2.3, 6.1.2, 6.0.12, 5.4.15, or 4.5.10 depending on your release branch. If you cannot upgrade immediately, stop exposing the dev server to untrusted networks (remove `--host` / set `server.host` to localhost) or firewall the dev-server port. Audit internet-facing hosts for running Vite dev servers and check access logs for requests containing `?raw??` or `?import&raw??`, which may indicate exploitation attempts.
Affected
vitejs vite
All versions prior to the fixed releases 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 (i.e., 6.2.x < 6.2.3, 6.1.x < 6.1.2, 6.0.x < 6.0.12, 5.4.x < 5.4.15, and 4.5.x
Estimated exposure
massmillions of installs run affected Vite versions (millions of weekly npm downloads); the remotely exploitable subset — network-exposed dev servers — is… — Vite has millions of weekly npm downloads as the default dev tooling for major frontend frameworks, but only dev servers started with `--host` or `server.host` are remotely reachable, an exposure pattern common in containerized, shared,…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.
Mass scanning campaign exploits CVE-2026-39364 in exposed Vite dev servers to steal AWS, Azure, and Terraform credentials.
F5 honeypots detected over 800 attacks and roughly 32,000 events in a month against internet-exposed Vite development servers, abusing CVE-2026-39364 (file access control bypass in Vite 7.1.0-7.3.2 and 8.x before 8.0.5) via parameters like ?raw and ?import&raw. Attackers used extensive wordlists to harvest .env files, AWS/Azure credentials, Terraform state, and /proc/self/environ, with double-encoded traversal to bypass WAFs. The same IPs also leveraged older Vite flaws CVE-2025-30208, actively-exploited CVE-2025-31125, and CVE-2024-45811, primarily from US, Belgium, and Netherlands using Google Cloud ranges.
Attackers mass-scanned exposed Vite dev servers exploiting CVE-2026-39364 to read .env files and steal AWS keys and Azure tokens, per F5 Labs honeynet data.
Honeynet telemetry recorded 807 session-grouped attacks and roughly 32,000 raw events in August 2026 against exposed Vite development servers. CVE-2026-39364 (CVSS 7.5) is an unauthenticated file-read flaw in Vite 7.1.0 through 7.3.2 and 8.0.5 that bypasses server.fs.deny via query parameters like ?raw and ?import&raw to return files in plaintext. Attackers also probed older Vite flaws CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811, and used wordlists to locate .env files, AWS credential files, Azure token stores, and Terraform state across Linux, container, and web paths. Exposed secrets could enable lateral movement or full cloud account takeover.
F5 honeypots record mass scanning of exposed Vite dev servers exploiting CVE-2026-39364 to harvest AWS and Azure cloud credentials.
F5 honeypots recorded 807 session-grouped attacks and roughly 32,000 raw events in August 2026 against internet-exposed Vite development servers, up from 1,732 events in the previous three months. Scanners abused CVE-2026-39364 (Vite 7.1.0-7.3.1, 8.0.0-8.0.4), bypassing server.fs.deny via @fs routes with ?raw/?import query parameters and double encoding to read .env files, AWS SSO caches, Azure tokens, and Terraform state. The same infrastructure also probed CVE-2025-29927 (Next.js), CVE-2025-30208, CVE-2025-31125 (KEV-listed January 2026), and CVE-2024-45811. Most traffic originated from Google Cloud IP ranges, with the US accounting for 17,297 events.
F5 honeypots logged 32,000+ probes against Vite file-access bypass CVE-2026-39364, hunting AWS and Azure credentials on exposed dev servers.
F5 Labs reported 32,000+ scan attempts (807 attack sessions) against exposed Vite servers in August, up from 1,732 attempts over the prior three months. Attackers exploited CVE-2026-39364 (CVSS 8.2), which bypasses Vite's server.fs.deny protection via parameters like ?raw and ?import&raw, affecting Vite 7.1.0 to before 7.3.2 and Vite 8 before 8.0.5. Scanners cycled wordlists for environment files, AWS keys, Azure tokens and IaC state files, also combining older Vite CVEs (2025-30208, 2025-31125, 2024-45811) and probing a Next.js middleware bypass. Only CVE-2025-31125 is currently in CISA's KEV catalog.