CVE-2026-39364: Exposed Vite Dev Servers Are Being Looted

A mass-scanning campaign is actively exploiting CVE-2026-39364, a high-severity Vite vulnerability that lets an unauthenticated attacker read any file the dev server can reach — including .env files, AWS credentials, and Terraform state. F5 Labs recorded over 32,000 attack events in August 2026 alone, a 19x spike from the prior three months. Affected versions: Vite 7.1.0–7.3.1 and 8.0.0–8.0.4. Fixed in 7.3.2 and 8.0.5. If you run --host, patch now and rotate credentials.

The Campaign Is Already Running

The vulnerability exists in how Vite’s transformMiddleware handles URL query parameters before applying server.fs.deny path checks. By appending ?raw, ?import&raw, or ?import&url&inline to any request, an attacker forces the middleware to evaluate the URL before the deny-list logic strips the query — so the check passes and the file is served with HTTP 200.

The only prerequisite is network exposure. The dev server must be reachable via --host or server.host: true in vite.config. This is a common pattern in Docker workflows and CI pipelines where the dev server is started for integration tests.

What Attackers Are After

From F5 Labs’ honeynet telemetry, the scanning wordlists are focused entirely on secrets and credentials. Attackers probe for:

• .env, .env.production, .env.local, .env.staging
• /root/.aws/credentials and /home/ubuntu/.aws/credentials
• terraform.tfstate and terraform.tfvars
• Azure access tokens and serverless config files
• /proc/self/environ for full process environment dumps

The end goal is cloud account takeover. AWS keys from a developer’s laptop can spin up instances, exfiltrate S3 buckets, and establish persistent IAM users. Notably, the attackers rotated User-Agent strings impersonating Googlebot, ClaudeBot, and PerplexityBot — blending with crawler traffic to complicate incident-response logs. F5 Labs recorded 807 session-grouped attacks generating roughly 32,000 raw events in August 2026.

How to Fix It

Patch first. Assess exposure second.

1. Update Vite. On 7.x, upgrade to 7.3.2. On 8.x, upgrade to 8.0.5 or later — 8.3.0 (released September 10) is current. Run npm update vite and confirm with npx vite --version.
2. Check your exposure window. If you’ve ever run a dev server with --host on a machine with open ports, assume exposure. Review cloud security groups and Docker port mappings. The GitHub advisory (GHSA-v2wj-q39q-566r) has indicators.
3. Rotate credentials. If exposure is plausible — even briefly — rotate every secret in your .env files: AWS keys, database passwords, API tokens. Don’t wait to investigate first.
4. Lock down your default. Dev servers should bind to 127.0.0.1. The common Docker pattern below is what makes this exploitable.

# Don't do this unless you have a specific need and understand the exposure
CMD ["vite", "--host", "0.0.0.0"]

# Prefer this
CMD ["vite"]

The Sixth Time Isn’t Charm

CVE-2026-39364 is the sixth server.fs.deny bypass in Vite since 2024. The prior five arrived through case-insensitive path matching, trailing URL separators, /. path injection, Windows backslash abuse, and ?import&raw parameter variants. Each patch closed the specific bypass, leaving the underlying URL canonicalization logic untouched.

The pattern is clear: Vite’s middleware chain needs a fundamental rethink of how it normalizes URLs before applying security checks — not another regex fix. Until that happens, server.fs.deny should be treated as a convenience, not a security boundary. The only reliable protection is not exposing the dev server to untrusted networks in the first place. Bleeping Computer has further coverage on the ongoing campaign.

Developer tools are quietly becoming the most lucrative attack surface in software. The same week as this campaign, researchers disclosed that ZCode was silently uploading entire git histories, and DeepSeek Harness had a sandbox escape that let an AI agent disable its own confinement. The tooling layer has always been trusted implicitly. Attackers have noticed.