Researchers Report Scanning of Exposed Vite Servers for Sensitive Files
Summary
Researchers recorded 807 sessions and about 32,000 events targeting exposed Vite servers in August 2026. The activity attempted to retrieve sensitive files through CVE-2026-39364, fixed in Vite 7.3.2 and 8.0.5.
Key points
- Researchers reported sustained scanning of internet-exposed Vite instances, recording 807 attack sessions and approximately 32,000 related events during August 2026.
- The activity targeted CVE-2026-39364, a file-disclosure vulnerability that can bypass protections for files accessible to Vite through specially crafted requests.
- Scans sought files associated with credentials and infrastructure, including .env files, AWS credentials, Azure tokens, and Terraform state files.
- Exploitation requires a network-reachable Vite service, an accessible target file, and a file matching a pattern protected by the server.fs.deny control.
- Affected versions are Vite 7.1.0–7.3.1 and 8.0.0–8.0.4; fixes are available in 7.3.2 and 8.0.5 or later.
- The confirmed impact is unauthorized access to protected files; access to connected services would depend on sensitive credentials being present and valid.
- Recommended steps include upgrading, reviewing external exposure, checking logs for suspicious requests, and rotating credentials that may have been exposed.
Article Details
- Vulnerability Types
- File disclosure
- Severity
- CVSS v4 score 8.2
- Affected Versions
- Vite 7.1.0 through 7.3.1
- Vite 8.0.0 through 8.0.4
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Limit development tools to trusted networks and avoid unnecessary internet exposure.
MITRE ATT&CK
T1005 · Data from Local SystemRequests attempted to retrieve sensitive files, including environment files, credentials, and Terraform state files, from exposed Vite hosts.T1190 · Exploit Public-Facing ApplicationScanning activity targeted network-accessible Vite development servers and exploited a file disclosure vulnerability.T1552.001 · Credentials In FilesScanning targeted credential files and environment files that could contain cloud credentials and tokens.