Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Active Exploitation of Vulnerability in Vite Development Servers

17 September 2026

Attackers are exploiting a high severity vulnerability in Vite development servers to retrieve restricted system and configuration files over HTTP. Patch immediately.

Background

F5 Labs recently reported on a mass scanning campaign exploiting a high-severity vulnerability (CVE-2026-39364) that affects Vite development servers. This vulnerability has a Common Vulnerability Scoring System (CVSS v3.1) score of 7.5 out of 10.

Known Exploitation

This vulnerability is reportedly being actively exploited.

Impact

Successful exploitation of the unauthenticated file-read and access-list bypass vulnerability could allow a remote, unauthenticated attacker to bypass server.fs.deny configurations and retrieve restricted system and configuration files over HTTP.

Affected Products

The vulnerability affects the following products:

  • Vite versions 7.1.0 to 7.3.1

  • Vite versions 8.0.0 to 8.0.4

  • Vite-plus versions 0.1.15 and earlier

Recommendations

Users and administrators of affected products are advised to update to the latest versions immediately.

References