All vulnerabilities
CVE-2025-31125GHSA-4r4m-qw57-chr8

Vite Vitejs Improper Access Control Vulnerability

Vite VitejsnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationExploited in the wildAdded to KEV 22 Jan 2026CISA KEV
Exploit odds (EPSS)65.2%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.2.4Also 6.1.3, 6.0.13 and 2 moreOSV
Federal deadline12 Feb 2026Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

  • 6.2.4vite, npmOSVnpm install vite@6.2.4
  • 6.1.3vite, npmOSVnpm install vite@6.1.3
  • 6.0.13vite, npmOSVnpm install vite@6.0.13
  • 5.4.16vite, npmOSVnpm install vite@5.4.16
  • 4.5.11vite, npmOSVnpm install vite@4.5.11

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 31 Mar 2025, 17:06 UTCPublishedCVE List
  2. 22 Jan 2026Added to CISA KEVCISA KEV

Public exploit code and templates 1

  • Scanner templateVite Development Server - Path TraversalNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Text from CVE List

Affected versions 10

  • viteaffected: >= 6.2.0, < 6.2.4CVE List
  • viteaffected: >= 6.1.0, < 6.1.3CVE List
  • viteaffected: >= 6.0.0, < 6.0.13CVE List
  • viteaffected: >= 5.0.0, < 5.4.16CVE List
  • viteaffected: < 4.5.11CVE List
  • vite, npmfrom 6.2.0, fixed in 6.2.4OSV
  • vite, npmfrom 6.1.0, fixed in 6.1.3OSV
  • vite, npmfrom 6.0.0, fixed in 6.0.13OSV
  • vite, npmfrom 5.0.0, fixed in 5.4.16OSV
  • vite, npmfrom first release, fixed in 4.5.11OSV

References 4