CVE-2025-30208

Published Mar 24, 2025

Last updated 5 months ago

Vite

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-30208 is a vulnerability affecting Vite, a frontend development tool. It exists in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. The vulnerability allows bypassing file access restrictions, which are normally in place to prevent access to files outside of a specified allow list. The bypass is achieved by adding "?raw??" or "?import&raw??" to the URL, which circumvents the intended restrictions and returns the file content. This occurs because trailing separators, such as "?", are removed in certain parts of the code but are not properly accounted for in query string regexes. Only applications that explicitly expose the Vite development server to the network (using the `--host` or `server.host` configuration options) are affected.

Description: Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.
Source: security-advisories@github.com
NVD status: Analyzed
Products: vite

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-200
nvd@nist.gov: NVD-CWE-noinfo

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 9

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A925DA49-0EFD-4E21-948C-FE4A45E9A58D",
            "versionEndExcluding": "4.5.10"
          },
          {
            "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "444AFEE6-1ED5-42A7-AC6D-0D1D829178DB",
            "versionEndExcluding": "5.4.15",
            "versionStartIncluding": "5.0.0"
          },
          {
            "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ABD9AA82-191F-45F4-BDF5-D3FAC0DD0D66",
            "versionEndExcluding": "6.0.12",
            "versionStartIncluding": "6.0.0"
          },
          {
            "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "932B0FAC-8C56-43F5-8F2E-322544BD7272",
            "versionEndExcluding": "6.1.2",
            "versionStartIncluding": "6.1.0"
          },
          {
            "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "578CF5D6-71AF-4A3B-BD07-D4C0A04C443A",
            "versionEndExcluding": "6.2.3",
            "versionStartIncluding": "6.2.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.