This critical vulnerability in Vitejs is actively exploited in the wild and allows unauthenticated attackers to access unauthorized sensitive files on affected systems.

This is an improper access control flaw where the Vite development server fails to restrict file access when using specific import parameters. An unauthenticated attacker can retrieve content from non-allowed files if the development server is explicitly exposed to the network using the host configuration option.

The exploitation of this vulnerability leads to the unauthorized disclosure of sensitive information, which may include source code, configuration files, or environment variables containing secrets. Given the CVSS score of 9.5, this flaw poses a severe risk to organizational data integrity and confidentiality. Active exploitation in the wild further elevates the urgency, as attackers are currently leveraging this weakness to gain unauthorized access to internal system files.

Immediate Action: Update Vitejs to the patched versions 6.2.4, 6.1.3, 6.0.13, 5.4.16, or 4.5.11 immediately.

Proactive Monitoring: Monitor server logs for suspicious requests containing ?inline&import or ?raw&import parameters, especially from external or unauthorized IP addresses.

Compensating Controls: Ensure that the Vite development server is not exposed to the public network or untrusted environments by disabling the --host or server.host configuration options unless strictly necessary and protected by additional network-level access controls.

Public Exploit Available: Yes, multiple public proof-of-concept repositories are available, and a Nuclei detection template exists.

Due to the confirmed active exploitation and the critical severity of this information disclosure vulnerability, immediate patching is required. Organizations must audit their development environments to identify any instances where the Vite server is exposed to the network and apply the provided updates without delay to prevent unauthorized data access.