CVE-2025-31125

Published Mar 31, 2025

Last updated a month ago

JavaScript

Vite

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-31125 is an arbitrary file read vulnerability that affects Vite, a frontend tooling framework for JavaScript. The vulnerability exists because Vite exposes the content of non-allowed files when using `?inline&import` or `?raw?import`. Exploitation is possible if the Vite development server is exposed to the network using the `--host` or `server.host` configuration options. An unauthenticated attacker can exploit this vulnerability by crafting malicious HTTP requests to read arbitrary files on the server, potentially leading to sensitive information leakage. Users can mitigate this vulnerability by updating to versions 6.2.4, 6.1.3, 6.0.13, 5.4.16, or 4.5.11. If upgrading is not immediately feasible, restricting access to the Vite development server can provide temporary relief.

Description: Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
Source: security-advisories@github.com
NVD status: Analyzed
Products: vite

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Vite Vitejs Improper Access Control Vulnerability
Exploit added on: Jan 22, 2026
Exploit action due: Feb 12, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

security-advisories@github.com: CWE-200
nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7A30C04F-CD9B-4205-BC89-9C9FE6C4B8D4",
            "versionEndExcluding": "4.5.11"
          },
          {
            "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B4B2C2B8-B924-4101-922A-F7164B58F683",
            "versionEndExcluding": "5.4.16",
            "versionStartIncluding": "5.0.0"
          },
          {
            "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4E94BAC6-64A0-4514-85EA-E307E267D688",
            "versionEndExcluding": "6.0.13",
            "versionStartIncluding": "6.0.0"
          },
          {
            "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7E8A7AC3-D23F-44DA-B505-59CE155792DB",
            "versionEndExcluding": "6.1.3",
            "versionStartIncluding": "6.1.0"
          },
          {
            "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B3710ACF-96C0-4931-A5A1-7810D116AADE",
            "versionEndExcluding": "6.2.4",
            "versionStartIncluding": "6.2.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.