National cyber security agencies and threat research labs have issued alerts confirming active wild exploitation targeting a high-severity access control bypass in a popular web application build tool and development server. Unauthenticated remote actors extract restricted system files and configuration parameters.
The vulnerability, tracked as CVE-2026-39364 with a CVSS score of 7.5, affects Vite development server versions 7.1.0 to 7.3.1, versions 8.0.0 to 8.0.4, and Vite-plus versions 0.1.15 and earlier. The defect involves an access-list bypass in file system serving handlers. Unauthenticated remote actors issue crafted HTTP GET requests to bypass server.fs.deny restrictions, retrieving sensitive configuration files, source code, and environment secret files from developer workstations and build hosts exposed to local network segments.
Compromising web development servers introduces severe intellectual property and credential exposure across development toolchains. When exposed development servers process unauthenticated file read requests, adversaries extract API integration keys, database credentials, and proprietary application source code.
– Force immediate maintenance upgrades across all projects using Vite to release builds 7.3.2, 8.0.5, or Vite-plus 0.1.16 or higher.
– Ensure development servers are configured to bind exclusively to local loopbacks 127.0.0.1 rather than public 0.0.0.0 interfaces.
– Inspect development build host access logs for anomalous HTTP GET requests attempting filesystem traversal or server config reads.
– Rotate all API tokens, cloud keys, and database passwords stored within environment configuration files on exposed developer hosts.
Development toolchain security depends on strict interface binding and rapid patch application to ensure web build environments remain protected from unauthenticated file read exploitation. #CodeDefence #Vite #DevSecOps #AppSec #FileRead #PatchManagement #WebSecurity #SupplyChain
/
