CVE

CVE-2025-31125

View on NVD ↗

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

Exploitation IoCs 3

IP 34[.]11[.]196[.]206

IP 34[.]14[.]15[.]105

IP 34[.]16[.]200[.]129

Source Articles

Hackers target exposed Vite dev servers to steal AWS, Azure secrets

Hackers are conducting a mass-scanning campaign targeting internet-exposed Vite development servers, exploiting CVE-2026-39364 to bypass file access controls and steal sensitive cloud credentials from AWS and Azure environments. The attackers use specific query parameters to retrieve environment files, cloud credentials, Terraform configurations, and system information. The activity has been observed originating from IP addresses in the United States, Belgium, and the Netherlands, with attackers leveraging Google Cloud infrastructure for evasion.

bleeping-computer Sep 14, 2026