Vibe Coding
The Vite dev server CVE has become an agent-infrastructure problem: 32,000 exploitation events in August
paddo.dev published on 2026-09-16 on Vite's `server.fs.deny` query bypass (CVE-2026-39364), patched April 6. F5 Labs recorded 32,000 exploitation events in August, an 18-fold jump, and the attacker wordlist names `/home/node/.aws/credentials`, `/usr/src/app` and `/proc/self/environ`, which are container paths, not laptop paths. The argument is that the dev server moved into containers and cloud VMs because that is where agents and previews run, and `--host` is the price of a port mapping. The author audited their own machine: 47 repos pin Vite, 28 pin a vulnerable version, and one had `allowedHosts: true` left over from a forgotten tunnel.
Source
↳ Follow the thread