CVE-2026-39364

Vite’s development server has a safety setting meant to block access to sensitive files (like your .env file). This bug lets an attacker request those blocked files anyway by adding certain “query tricks” to the URL. In real attacks, scammers scan the internet for exposed dev servers and try to steal cloud credentials from files like .env.

This matters if your business runs the Vite development server and it is reachable over the network (especially from the internet). It specifically impacts Vite dev server versions between 7.1.0 and <7.3.2 and version 8.0.5, when server.fs.deny is in use. The risk is greatest when the vulnerable dev server is exposed and reachable from the network without an attacker needing a login.

Attackers are actively scanning for exposed Vite development servers and using wordlists to pull secrets; exploitation has been reported. With a RED verdict, you should treat this as an urgent credential-theft risk if your Vite dev server is publicly reachable or otherwise reachable by untrusted networks.

1. Confirm exposure

   • Identify where the Vite dev server is running (local dev only vs. deployed/hosted dev server).
   • Determine the Vite version used by each affected service.
   • Verify network reachability: is the dev server accessible from the public internet or any untrusted network?

2. Confirm likely exposure to this bug

   • If you run Vite dev server version 7.1.0 to <7.3.2 or 8.0.5, assume you are affected.
   • The bypass applies when protected files are requested while server.fs.deny is active, because query parameters can cause Vite to return the blocked file contents.

3. Upgrade to fixed versions

   • Upgrade Vite to 7.3.2 (for the 7.x line) or to 8.0.5+ (for the 8.x line).
   • Coordinate with your build/dev tooling so the team can keep working normally after the dependency update.

4. Immediate containment (if you can’t upgrade right away)

   • Remove public exposure immediately by restricting access to the dev server to localhost, VPN, or your internal network only.
   • Stop any currently exposed instances until the upgrade is complete.

5. If there’s any chance it was reachable while vulnerable

   • Rotate credentials that may have been present in .env files (cloud provider keys/tokens, API keys, Terraform-related secrets).
   • Review server/proxy logs for patterns consistent with secret hunting (requests targeting .env-like files and credential artifacts).

6. After patching

   • Continue monitoring logs for follow-on scanning attempts.
   • Ensure secrets are not unnecessarily stored in .env on machines/services that are internet-reachable.

Severity is HIGH (CVSS 7.5) and the operational verdict is RED due to reported exploitation and sustained scanning activity. The weakness is a server.fs.deny bypass (CWE-180, plus related CWE-284 and CWE-472 themes), where the Vite dev server can be coerced into serving the contents of files that should be denied by adding specific query parameters to the request URL. The attacker does not need authentication or user interaction (network-accessible endpoint only).

Exploit maturity: exploitation reported in the wild; press reporting describes mass-scanning of exposed Vite dev servers, including use of wordlists targeting .env, AWS/Azure credential files, and Terraform-related files. KEV is not listed for this CVE, so detection depends on patching and exposure control. The vendor fix is available via the Vite security advisory (fixed in 7.3.2 and 8.0.5+).