Vite Dev Server Improper Access Control Exposes Protected Files (Actively Exploited)
CISA: Vite Vitejs Improper Access Control Vulnerability
CVSS 3.1
7.5high
EPSS
58%p99
Published
()
KEV added
AI analysis
CVE-2025-31125 is an improper access control flaw (CWE-284/CWE-200) in the Vite JavaScript frontend tooling's dev server, where HTTP requests using the '?inline&import' or '?raw?import' query parameters can read the contents of files the dev server should not serve, bypassing its file-access restrictions (server.fs.deny). An unauthenticated remote attacker (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) triggers it by sending crafted requests with these query parameters to a running Vite dev server. The attacker gains read access to arbitrary files on the machine running the dev server, such as source code and .env files containing secrets, with high confidentiality impact and no integrity or availability impact. Only applications that explicitly expose the Vite dev server to the network via the --host flag or the server.host option are affected; production builds are not impacted. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-01-22 (ransomware association unknown), and EPSS assigns a 58.5% probability of exploitation within 30 days (99th percentile).
What to do: Upgrade Vite to 6.2.4, 6.1.3, 6.0.13, 5.4.16, or 4.5.11 depending on your release line. Until patched, do not expose the dev server to untrusted networks (remove --host/server.host or bind to localhost behind an access-controlled proxy), and review access logs for requests using ?inline&import or ?raw?import that retrieved sensitive files such as .env. As a KEV entry added 2026-01-22, U.S. federal agencies must apply vendor mitigations per BOD 22-01 or discontinue use if mitigations are unavailable.
Affected
vitejs vite
Releases before the fixed version in each line: 4.x < 4.5.11, 5.x < 5.4.16, 6.0.x < 6.0.13, 6.1.x < 6.1.3, 6.2.x < 6.2.4 (only when the dev server is exposed to
Estimated exposure
largeplausibly tens of thousands to ~100,000 network-exposed Vite dev servers, out of millions of total Vite users — Vite is a mainstream frontend build tool with developer adoption in the millions (on the order of tens of millions of weekly npm downloads), but the flaw only applies to dev servers deliberately bound to non-localhost interfaces via --host…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
CISA Known Exploited Vulnerability
Affected
Vite Vitejs
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Mass scanning campaign exploits CVE-2026-39364 in exposed Vite dev servers to steal AWS, Azure, and Terraform credentials.
F5 honeypots detected over 800 attacks and roughly 32,000 events in a month against internet-exposed Vite development servers, abusing CVE-2026-39364 (file access control bypass in Vite 7.1.0-7.3.2 and 8.x before 8.0.5) via parameters like ?raw and ?import&raw. Attackers used extensive wordlists to harvest .env files, AWS/Azure credentials, Terraform state, and /proc/self/environ, with double-encoded traversal to bypass WAFs. The same IPs also leveraged older Vite flaws CVE-2025-30208, actively-exploited CVE-2025-31125, and CVE-2024-45811, primarily from US, Belgium, and Netherlands using Google Cloud ranges.
Attackers mass-scanned exposed Vite dev servers exploiting CVE-2026-39364 to read .env files and steal AWS keys and Azure tokens, per F5 Labs honeynet data.
Honeynet telemetry recorded 807 session-grouped attacks and roughly 32,000 raw events in August 2026 against exposed Vite development servers. CVE-2026-39364 (CVSS 7.5) is an unauthenticated file-read flaw in Vite 7.1.0 through 7.3.2 and 8.0.5 that bypasses server.fs.deny via query parameters like ?raw and ?import&raw to return files in plaintext. Attackers also probed older Vite flaws CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811, and used wordlists to locate .env files, AWS credential files, Azure token stores, and Terraform state across Linux, container, and web paths. Exposed secrets could enable lateral movement or full cloud account takeover.
F5 honeypots record mass scanning of exposed Vite dev servers exploiting CVE-2026-39364 to harvest AWS and Azure cloud credentials.
F5 honeypots recorded 807 session-grouped attacks and roughly 32,000 raw events in August 2026 against internet-exposed Vite development servers, up from 1,732 events in the previous three months. Scanners abused CVE-2026-39364 (Vite 7.1.0-7.3.1, 8.0.0-8.0.4), bypassing server.fs.deny via @fs routes with ?raw/?import query parameters and double encoding to read .env files, AWS SSO caches, Azure tokens, and Terraform state. The same infrastructure also probed CVE-2025-29927 (Next.js), CVE-2025-30208, CVE-2025-31125 (KEV-listed January 2026), and CVE-2024-45811. Most traffic originated from Google Cloud IP ranges, with the US accounting for 17,297 events.
F5 honeypots logged 32,000+ probes against Vite file-access bypass CVE-2026-39364, hunting AWS and Azure credentials on exposed dev servers.
F5 Labs reported 32,000+ scan attempts (807 attack sessions) against exposed Vite servers in August, up from 1,732 attempts over the prior three months. Attackers exploited CVE-2026-39364 (CVSS 8.2), which bypasses Vite's server.fs.deny protection via parameters like ?raw and ?import&raw, affecting Vite 7.1.0 to before 7.3.2 and Vite 8 before 8.0.5. Scanners cycled wordlists for environment files, AWS keys, Azure tokens and IaC state files, also combining older Vite CVEs (2025-30208, 2025-31125, 2024-45811) and probing a Next.js middleware bypass. Only CVE-2025-31125 is currently in CISA's KEV catalog.