CVE-2025-30208
CVSS 5.3 MEDIUM: vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. EPSS 75% (99th percentile).
Vulnerabilities & Exploits · Web App Attack
Attackers are actively probing internet-exposed Vite development servers using CVE-2025-30208. They send requests with the '/@fs/' prefix and a '?raw??' suffix to bypass Vite's directory allowlist and download arbitrary files like /etc/environment and .aws/credentials. Vite dev servers typically listen on port 5173 and should not be internet-facing, but attackers scan common web ports assuming exposure.
This exploitation targets development-only features that expose plaintext secrets and credentials. The low scan volume masks the real risk, as exposed dev servers often contain sensitive configuration files. Teams should search logs for '/@fs/' and '?raw??' patterns, block or monitor port 5173, and rotate any exposed credentials. This is a high-risk issue for any environment with internet-reachable Vite dev servers but not a widespread emergency.
1 source · Apr 2
CVSS 5.3 MEDIUM: vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. EPSS 75% (99th percentile).
SANS ISC
Attempts to Exploit Exposed
Attempts to Exploit Exposed "Vite" Installs (CVE-2025-30208), Author: Johannes Ullrich
originalPart of the PlainSec briefing for 2026-04-03
Every edition of this story: Attackers Exploit Vite Dev Server Feature to Steal Files