The Vite dev-server CVE became an agent-infrastructure problem.

paddo.dev's September 16 analysis tracks CVE-2026-39364, the server.fs.deny query bypass patched April 6. F5 Labs recorded 32,000 exploitation events in August, an 18-fold jump, and the attacker wordlist names /home/node/.aws/credentials, /usr/src/app and /proc/self/environ. Those are container paths. The argument is that dev servers moved into containers and cloud VMs because that's where agents and preview environments run, and --host is the price of a port mapping. The author audited their own machine: 47 repos pin Vite, 28 pin a vulnerable version, one had allowedHosts: true left from a forgotten tunnel.