Actively exploited · Published Mar 31, 2025 · Assigned by GitHub_M
CVE-2025-31125Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
Medium 5.3 Exploited
In plain English
A medium-severity information exposure in vite from vitejs. Attackers are actively exploiting it in the wild (listed by CISA on January 22, 2026). The chance it is exploited in the next 30 days is estimated at 74.9% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Feb 12, 2026.
Official description
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | vite | 6.2.4 | GHSA-4r4m-qw57-chr8 |
| npm | vite | 6.1.3 | GHSA-4r4m-qw57-chr8 |
| npm | vite | 6.0.13 | GHSA-4r4m-qw57-chr8 |
| npm | vite | 5.4.16 | GHSA-4r4m-qw57-chr8 |
| npm | vite | 4.5.11 | GHSA-4r4m-qw57-chr8 |
Affected products (as reported)
Weakness: CWE-200, CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N