CVE-2024-45811

Medium4.8 Published on Sep 17, 2024

Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Early warning: exploitation observed

Exploitation observed since Sep 11, 2026
Not yet in the official CISA catalogue
First attack observed 723 days after disclosure

Source: VulnCheck KEV · Sep 11, 2026

CVSS score4.8 / 10CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness type (CWE)CWE-200, CWE-284

Vulnerabilities

Hackers Scan Exposed Vite Servers for AWS, Azure, and Deployment Secrets

Hackers are scanning exposed Vite dev servers via CVE-2026-39364 to steal AWS keys, Azure tokens, .env files and Terraform state. Learn risks and fixes.

Sep 15, 202601:53 5 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Early warning: exploitation observed

Related articles

Hackers Scan Exposed Vite Servers for AWS, Azure, and Deployment Secrets