Vite Vitejs Improper Access Control Vulnerability
vitejs — vite
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
5.3
58.5%
Vector breakdown
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- Published
- Mar 31, 2025
- Modified
- Jun 17, 2026
- Added to KEV
- Jan 22, 2026
- Federal patch due
- Feb 12, 2026
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Weakness classification
Affected packages
Proof-of-concept & exploitation references
6 foundWeaponization
Public repositories whose name or description references CVE-2025-31125, found via a live GitHub search at request time. These are community-sourced signals, not a verified working exploit - cross-check each one before relying on it, and treat higher star counts and recent activity as (weak) corroboration, not proof.
- xuemian168/CVE-2025-30208★ 49
全网首发 CVE-2025-31125 CVE-2025-30208 CVE-2025-32395 Vite Scanner
updated Sep 21, 2026
- jackieya/ViteVulScan★ 7
针对CVE-2025-30208和CVE-2025-31125的漏洞利用
updated May 15, 2025
- sunhuiHi666/CVE-2025-31125★ 6
Vite 任意文件读取漏洞POC
updated Jun 10, 2026
- MuhammadWaseem29/Vitejs-exploit★ 0
Vite Development Server's @fs endpoint (CVE-2025-31125) to access sensitive files like /etc/passwd and /etc/hosts via crafted URLs.
updated Jul 25, 2025
- 0xgh057r3c0n/CVE-2025-31125★ 0
Vite WASM Import Path Traversal 🛡️
updated Aug 13, 2025
- harshgupptaa/Path-Transversal-CVE-2025-31125-★ 0
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
updated Sep 19, 2026
References
How this class of flaw gets exploited
Frequently asked questions
What is CVE-2025-31125?
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
How severe is CVE-2025-31125?
CVE-2025-31125 has a CVSS base score of 5.3 out of 10 (CVSS 3.1).
Is CVE-2025-31125 actively exploited in the wild?
Yes. CVE-2025-31125 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added Jan 22, 2026, meaning CISA has confirmed evidence of active exploitation.
What is the EPSS score for CVE-2025-31125?
58.5% - meaning FIRST.org's EPSS model estimates a 58.5% probability this vulnerability will be exploited in the wild within 30 days (99% percentile among all scored CVEs).
Is there exploit tooling available for CVE-2025-31125?
Yes - a public Nuclei template referencing CVE-2025-31125 exist in public repositories we checked. We also found 6 public GitHub repositories referencing this CVE.
What type of vulnerability is CVE-2025-31125?
CVE-2025-31125 is classified under CWE-200, CWE-284 (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor).
Cross-checked against
Impactr finds and proves whether CVE-2025-31125 - or flaws like it - are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.
Join the waitlist